Deus Finance DAO has suffered another exploit, losing $13.4 million worth of ETH to a hacker less than a month after it was hacked in a similar flash loan attack for about $3 million.

Deus DAO lost over $16 million from the two attacks

Blockchain security firm PeckShield was the first to report the exploit, claiming that while the hacker gained around $13.4 million, the protocol may have lost more.

According to PeckShield, the hacker used a flash loan to manipulate the price oracle and inflate the value of DEI. Then the hacker used the inflated DEI as collateral to borrow and dump the log. The exploit in March was achieved using the same method.

The hacker initially subtracted 800 ETH out of Tornado Cash To mimic the exploit, send the funds in via Multichain fantom. After stealing the money, the hacker paid off the flash loan and sent the proceeds to his wallet.

As it now turns out, the hacker withdrew most of the proceeds from the bank walletsince there was only 0.85 ETH in the wallet at the time of writing.

Response from the Deus team

In its initial response, Deus Finance called for DAO to calm down after revealing that its team was working on it. The log claimed that all user funds were safe and no user had been liquidated as a result of the exploit.

The multichain decentralized derivatives platform also announced that the $DEI binding has been restored and that it will provide more updates soon.

Its founder, the pseudonymous Lafachief, disagreeing with the description of the exploit by PeckShield.

He added that the protocol uses “Muon Oracles not onchain” and the hacker “was able to manipulate Muon’s VWAP prices.” He went on to say that the attacker “essentially ‘faked’ the exchange of ~2M USDC to 100,000 DEI” and thereby “rigged the Muon VWAP price”.

Lossless DeFi, a crypto hack mitigation tool, also offered to help Deus catch the hacker if it were willing to cooperate.

However, some users are concerned about the security of the platform considering that the same exploit happened twice in less than a month.


What's your reaction?
Leave a Comment