TECRA Hack

The exploiter's address:

Address 0xb19b…c299

The transaction behind the exploit:

Tx 0x81e9…1154

The attacker:

• Approved a big number of tokens to the Uniswap pool
• Bought 101 TCR from the pool
• Used the loophole to burn the TCR owned by the pool, increasing the TCR price
• Used the bought TCR to take away a lot of USDT

Wrong implementation:

function burnFrom(address from, uint256 amount) external {

require(_allowances[msg.sender][from] >= amount, ERROR_ATL);

Correct one:

require(_allowances[from][msg.sender] >= amount, ERROR_ATL);

The actual token implementation allows any account A to burn tokens from any other account B if account A approves that number of tokens to B.

The part of the stolen funds was deposited into Tornado Cash mixer, and the rest holds on the exploiter's address:

Source