- The Hack: Exploiting a Major Flaw
- Returning the Funds: The First Step to Recovery
- Future Plans
The decentralized finance protocol Shezmu fell victim to a $5 million theft after a hacker exploited a vulnerability in its vault system. Unexpectedly, Shezmu managed to recover most of the stolen funds through negotiations with the hacker.
The Hack: Exploiting a Major Flaw
The attack occurred when the hacker found a flaw in one of Shezmu’s vaults. This allowed him to mint unlimited collateral and take out loans in ShezUSD without any limits. Using this loophole, the hacker was able to drain around $5 million from the platform. Instead of pursuing legal action, Shezmu decided to negotiate with the hacker, offering a 10% bonus if the stolen tokens were returned. The hacker countered with a demand for 20%, and Shezmu agreed. This deal put an end to further losses and avoided legal complications.
Returning the Funds: The First Step to Recovery
In less than a day, the hacker started to return the stolen assets, including DAI and 419.18 ETH with wETH. Shezmu assured that all remaining funds would be recovered. Shezmu laid out a plan to support the liquidity providers (LPs) affected by the hack. LPs holding ShezUSD and ShezETH paired assets on Curve, Balancer, and Beefy will be identified through screenshots. These LPs will receive an airdrop covering 80% of the lost liquidity. The remaining 20% will be compensated through debt tokens, which can be redeemed using protocol fees and treasury assets.
Future Plans
Shezmu activated recovery mode for its Balancer ShezETH pool, allowing LPs to withdraw their funds but preventing new deposits or swaps for now. The protocol plans to release a full post-mortem report to explain what happened and detail the steps it’s taking to prevent future incidents.
The Shezmu incident highlights the importance of robust security in the DeFi space. Although the hacker managed to extract significant funds, effective negotiation strategy led to the recovery of most of the stolen assets.
