New Ethereum DeFi Exploit Sees $14M Stolen From Furucombo

A new Ethereum DeFi exploit sees $14 million stolen from the batching protocol Furucombo as per the reports that we have in our latest cryptocurrency news.

The DeFi exploits are becoming an everyday thing as the space evolves and attracts both participants and money. The latest of these attacks happened earlier today and saw more than $14 million worth of stolen crypto. Furucombo is an ETH-based batching protocol to announced that the platform was exploited and asked all users to cease all approvals as caution. The tool is built for end-users to optimize the DeFi strategy by using a simple drag and drop mechanism allowing the users that don’t know how to code but understand DeFi markets, to create their own strategies. The protocol said in a tweet on the new ethereum DeFi exploit:

 “We have deauthorized the relevant components and believe the vulnerability to be patched but we recommend users remove approvals out of an abundance of caution.”

Today at 4:47 PM UTC the Furucombo proxy was compromised by an attacker. We have deauthorized the relevant components and believe the vulnerability to be patched but we recommend users remove approvals out of an abundance of caution.

— FURUCOMBO (@furucombo) February 27, 2021

According to the Block researcher Igor Igamberdiev, the attacker was able to conduct the exploit by tricking the smart contracts of the platform to trust and process a fake dataset that belongs to the lending service Aave which is a protocol that allows users to take out loans via collateral, as the tweet explained:

 “An attacker using a fake contract made Furuсombo think that Aave v2 has a new implementation.”

Igamberdiev said that this caused all interactions with Aave V2 to be approved and eventually sent to an address controlled by the hacker. The on-chain data shows that the attacker transferred the funds of every user that approved Furucombo to conduct transactions on their behalf which resulted in million getting stolen.
buy vilitra generic https://cialisnextdaydeliveryusa.com/vilitra.html over the counter

More than 3900 stETH and $2.4 million in USDC were the biggest bags hit and the attackers even transferred their stash to Tornado, the privacy mixer that masks addresses and allows users to swap cryptocurrencies on-chain.

Revoke your access to @furucombo ASAP. https://t.co/TmWP61dUn0

— Julien Bouteloup (@bneiluj) February 27, 2021

The CEO of Dinngo, Hsuan-Ting who maintains Furucombo, said that the firm takes responsibility for getting attack and asked users not to worry about their losses. He said:

 “Will keep everyone posted. Together we are stronger.”

In the meantime, Curve Finance’s Julien Boutleoup said that these evil contract exploits are the new “holy grail.” He referred to previous attacks on Alpha Finance and Pickle Finance.