Exactly Protocol, a lending-borrow project operating on Layer 2 Optimism, has fallen victim to a major security breach. The attack has resulted in an estimated loss of more than $12 million USD for the protocol, sending shockwaves through the cryptocurrency community.
Security firms were quick to respond to the breach, with PeckShield, a prominent blockchain security company, first sounding the alarm. The initial reported damage was around $7.3 million USD, but this figure quickly escalated as further details emerged.
Hi @exactlyprotocol, we have detected an ongoing attack. Users are strongly suggested to take necessary actions.
Here is the encrypted hash: 20bae0a96e90d5590a98bc81a16c2b1e8e96eba8248f266c244870d18232b258. Actual hash will be released once the situation is stable.
— PeckShield Inc. (@peckshield) August 18, 2023
PeckShield took to Twitter to announce their findings, issuing a warning to users of Exactly Protocol. The security firm tweeted, “@exactlyprotocol, we have detected an ongoing attack. Users are strongly suggested to take necessary actions.” They also provided an encrypted hash (20bae0a96e90d5590a98bc81a16c2b1e8e96eba8248f266c244870d18232b258) as part of their response to the incident.
However, the extent of the damage continued to grow. De.Fi, a platform specializing in security solutions for decentralized finance, reported that a staggering 7,160 ETH, equivalent to over $12 million USD, had been stolen from the protocol. The attackers had managed to exploit vulnerabilities within Exactly Protocol’s smart contract, executing three transactions of varying values and causing substantial losses.
🚨 Exploit Update: Exactly Protocol Hack 🚨
Over 7160 $ETH stolen (~$12,040,000) – the total bridged ETH amount.
Two exploiter contracts identified. Numerous calls to the function kick()
🧵 On-chain details of the attack 👇 https://t.co/WusoM96vhF pic.twitter.com/30q2wK9DmB
— De.Fi 🛡️ Web3 Antivirus (@DeDotFiSecurity) August 18, 2023
Exactly Protocol, which boasted a total value locked (TVL) of over $36 million USD, as per DeFiLlama data, saw its TVL plummet to under $16 million USD following the attack. The protocol’s native token, EXA, experienced a sharp decline of more than 21% in value amidst the news of the breach.
Designed to facilitate decentralized lending with both fixed and variable interest rates, Exactly Protocol was also set to distribute governance token EXA through an airdrop. The project had successfully completed a $2 million USD funding round led by Kain Warwick, co-founder of Synthetix, and Esteban Ordano, co-founder of Decentraland, along with other partners. This funding round took place starting from January 2023.
The protocol initially launched in July 2021 and transitioned to the Ethereum blockchain’s mainnet in November 2022. Later, in March 2023, the project officially shifted its operations to the OP Stack on the Optimism platform.
The breach raises significant concerns about the security of Layer 2 solutions, which have been touted as a means to enhance scalability and reduce fees on the Ethereum network. As the investigation into the attack unfolds, the DeFi community will be closely watching to see how the Exactly Protocol team responds and whether the stolen funds can be recovered.
Read more:
- Zunami Protocol Issues Warning After $2.1 Million Theft From Curve Pool
- Hacker Wintermute Controls Over 51% Liquidity In Curve’s 3pool