Particle Trade Hack

Particle trade, a decentralized leverage trading protocol, was exploited, resulting in the loss of 141,684 USD worth 50.12 WETH.

Particle trade is a permissionless decentralized leverage trading protocol for any digital asset. On February 15, 2024, the project was exploited due to a contract vulnerability in its previously deprecated NFT contract. The contract does not check the user input data for onERC721Received() function which make the order 'legit' and manipulated the accountBalance.

The current protocol of Particle trade was not impacted by this security incident, confirmed by @wukong_particle in a post on the X. The attacker deposited the stolen funds into TornadoCash.

Attacker Address:

https://etherscan.io/address/0x2c903F97…3f5559

Malicious Transaction:

https://etherscan.io/tx/0x2cc3c3cf…83514a

Malicious Contract Address:

https://etherscan.io/address/0xE55607B2…77Ef8F

TornadoCash Deposit Transactions:

https://etherscan.io/tx/0x4bb78bbf…47bcc4

https://etherscan.io/tx/0x32fe57bd…220894