What happened
On December 8, 2021, an eCurve exploit allowed unbacked collateral to be created and used to drain PIZZA Lend on EOS. The EOS Network Foundation later described roughly $10 million in stolen assets. Its account says the attacker distributed assets across 1.37 million accounts and ultimately returned the funds except for an agreed $500,000 bounty.
Technical root cause
PIZZA Lend accepted collateral whose backing had been compromised through eCurve. The incident crossed the boundary between the collateral issuer and the lending market.
How it happened
- The eCurve exploit enabled the attacker to create collateral without equivalent backing.
- That collateral was used to drain PIZZA Lend.
- The attacker dispersed assets across approximately 1.37 million accounts while responders prepared account restrictions.
- After negotiations, the attacker accepted a $500,000 bounty and returned the remaining funds, according to the EOS Network Foundation.
Protocol details
Classification
Other / Token & Share Accounting
Protocol Type
Lending
Implementation language
C++
Protocol links
Website
@PizzaProFi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
