Ploutoz Finance Hack

The attacker's address:

https://bscscan.com/address/0x2f618493…6b315e

The transaction behind the attack:

https://bscscan.com/tx/0x7fe46c27…099457

The attacker:

- flash loaded 1,000,400 BUSD from PancakeSwap BNB/BUSD pair

- swapped 1,000,00 BUSD for 570,234 DOP tokens to push the price up

- swapped 400 BUSD for 8,841 DOP

- borrowed 86,921 BUSD, 85 CAKE, 18,000 DLOOY, 18 ETH, 1.69 BTCB, 89,000 USDT on Ploutoz Finance using pumped DOP as collateral

- reversed swap and repaid the flash loan.

The hack is made possible due to the price oracle manipulation of DOP.

Stolen funds were deposited into Tornado Cash mixer at:

https://bscscan.com/tx/0x9f7d1936…81ec3d

https://bscscan.com/tx/0x3f7ca0eb…0e7abd

https://bscscan.com/tx/0x93b1f71d…bdcb04

https://bscscan.com/tx/0xfeeb8639…1bd118

https://bscscan.com/tx/0x0cd229b7…50effd

https://bscscan.com/tx/0x12462e50…32330d

https://bscscan.com/tx/0x01900c31…9bb34b

https://bscscan.com/tx/0x2dbc7bf0…c3b2fa

https://bscscan.com/tx/0x107de0ba…73c391