1. Attack Details
2. Consequences and Reaction
3. Transfers and Hacker's Actions

Recently, the Penpie DeFi protocol based on Pendle was subjected to an attack, resulting in $27 million worth of cryptocurrency being stolen.

Attack Details

The attacker stole approximately $27 million worth of cryptocurrency in various types of staked Ethereum (ETH). The stolen ETH types include wstETH, agETH, rswETH, as well as Ethena’s sUSDE and wrapped USDC.

Consequences and Reaction

Pendle confirmed that it had identified a security vulnerability in the Penpie protocol and that it would continue to communicate closely with the team. Pendle stated that investors’ funds were safe at Pendle, but that it had temporarily paused all contracts as a precaution.

Transfers and Hacker's Actions

Blockchain security firm PeckShieldAlert shared that the Penpie attacker first transferred 1000 ETH worth $2.44 million to Tornado Cash. The attacker then transferred an additional 1,900 ETH worth an additional $4.5 million to Tornado Cash. Another transaction was made by the attacker, moving another 1000 ETH worth approximately $2.4 million to Tornado Cash. PeckShieldAlert estimates that the attacker still has 7.1K ETH in his possession.

The attack on Penpie led to significant losses in the market and a drop in the price of Penpie (PNP) by 40% and Pendle (PENDLE) by 8.5%. Efforts to fix the vulnerability are ongoing.