On September 3, the decentralized finance (DeFi) protocol Penpie, built on Pendle, was hacked, resulting in the loss of $27 million in various cryptocurrencies.
The Exploit
The hack was first brought to light by an X account affiliated with Fuzzland, claiming that $17 million had been drained from Penpie. The protocol was unaware of the breach even after it had begun, leading to an additional $10 million in losses. The hacker exploited a specific security weakness in Penpie’s system, enabling them to drain funds swiftly. Most of the stolen assets were converted into 11,109 ETH. Of this amount, the hacker laundered 1,000 ETH through the crypto mixer Tornado Cash. Blockchain data revealed that the exploiter's address was initially funded with 10 ETH from Tornado Cash just hours before the attack took place.
Response from Penpie and Pendle
Penpie confirmed the security breach in an X post approximately an hour after the hack began, immediately pausing all deposits and withdrawals to prevent further losses. > > "Alert: Penpie has encountered a security compromise. > We have paused all deposits and withdrawals. Our team is working tirelessly to address it. Your patience and support are invaluable during this time. Stay tuned for further updates." > > (Penpie, September 3, 2024) Pendle also took action, pausing all contracts on their platform as a precautionary measure, safeguarding approximately $105 million. Pendle confirmed that their funds were secure and that the breach was specific to Penpie. Pendle’s team identified the attack and mobilized efforts to protect their ecosystem, reaching out to security experts at Seal 911 to evaluate the situation and devise strategies to prevent further breaches.
Penpie's Appeal to the Hacker
Penpie reached out to the hacker with an offer to negotiate a bounty for the safe return of the stolen funds, promising not to pursue legal action if the funds were returned. They also offered the hacker an opportunity to transition into a white-hat role, where their skills would be recognized and rewarded.
As of the latest updates, Penpie’s stolen funds have been partially transferred to Tornado Cash, making recovery efforts more challenging. Penpie is actively working to ensure that users can securely withdraw their remaining funds.
Comments