DeFi protocol Zunami was exploited on Monday, leading to up to $2.1 million in losses, according to blockchain data analytics firm Peckshield. The hacker exploited the yield aggregator using price manipulation, the security firm revealed in a tweet.
“Hi zunamiprotocol, we have detected an ongoing attack. Users are strongly suggested to take necessary actions,” Peckshield tweeted.
Zunami also confirmed the hack in a tweet and strongly advised users against buying its Ethereum (zETH) and stablecoin (UZD) products.
“It appears that zStables have encountered an attack. The collateral remain secure, we delve into the ongoing investigation,” Zunami tweeted. “Please do not buy zETH and UZD at the moment, their emission has been attacked,” the protocol added.
Price Manipulation
The hacker deposited 9.95 ETH through Tornado Cash, which he deployed to Zunami for the attack. The exploiter then donated to incorrectly calculate the price of UZD, inflating the hacker’s asset value. After the manipulation, the hacker cashed out the 1,179 ETH ($2.17 million) realized and quickly washed it through the mixing services on Tornado Cash.
The hack significantly impacted the prices of zETH and UZD, as they both lost their pegs with Ethereum and USD, respectively. zETH dropped 85% to $278, while UZD dropped over 99% to $0.006.
Foreseen Incident
Xian Yu, the founder of Asian-based security firm SlowMist, tweeted after the attack that his company foresaw the loophole in Zunami’s system and reported it. However, he noted that the yield aggregator didn’t find the information pleasing.
“This project was attacked by price manipulation and lost more than 2.1 million US dollars. The key point is that our system detected their risk two months ago, and we informed them privately in advance. Unfortunately, it was an unpleasant communication…. It now appears that perhaps they were avoidable,” he tweeted.
