Cryptocurrency

Tweet by PeckShieldAlert

2022-12-23 [vendor] Defrost Finance [chain] avalanche
Primary Source ↗
Recovered $12.0M
Blockchain(s) Avalanche

Incident Details

Defrost Finance, a defi trading platform built on the Avalanche Network, apparently tried and failed to rug pull its users. The project claimed on December 23 that they were “sad to announce that our V2 has suffered a hack, with an attacker using a flash loan function to withdraw funds”. They later announced that this “hacker” had also managed to exploit the v1 version of their project. Altogether, it appeared that tokens valued at around $12 million had been stolen.Observers were quick to notice that the “hack” was made possible by the addition of a fake collateral token, which was then manipulated to liquidate the protocol’s users, suggesting the “hack” was likely an inside job.On December 26, Defrost claimed that the “hacker” had miraculously returned the money. The announcement didn’t seem to convince the project’s users, who left comments like, “It was never hacked. You tried to rug your users”.Defrost Finance’s team had previously run a project called FinNexus, which also suffered a “hack” in May 2021 that was widely believed to have been a rug pull.

Technical Details

Initial Attack Vector
Flash loan attack on smart contract
Vendor / Product
Defrost Finance

Timeline

  1. 2022-12-23 Breach occurred
  2. 2022-12-23 Publicly disclosed