On September 3, the decentralized finance (DeFi) protocol Penpie, built on Pendle, was hacked, resulting in the loss of $27 million in various cryptocurrencies.
The Exploit and Methods
According to EmberCN, the stolen funds included Ether (ETH) and stablecoins like wrapped USDC and sUSD. The hacker exploited a vulnerability in Penpie's security, converting most of the stolen assets into ETH and then transferring them to a new Ethereum address, making it difficult to trace.
Response from Penpie and Pendle
Penpie confirmed the security breach in an X post approximately an hour after the hack began. The protocol immediately paused all deposits and withdrawals to prevent further losses. Pendle, the platform on which Penpie is built, also took precautionary measures, pausing all contracts on Pendle to safeguard approximately $105 million that could have been at risk.
Appeal to the Hacker and Aftermath
Penpie reached out to the hacker with an offer to negotiate a bounty for the safe return of the stolen funds. The protocol emphasized the importance of the stolen funds to their community and expressed a willingness to resolve the issue cooperatively. Meanwhile, part of the stolen funds was transferred to Tornado Cash, making recovery efforts more challenging.
Penpie continues to work on improving the platform's security and ensuring that users can securely withdraw their remaining funds.
Comments