Zabu Finance, a DeFi application built on the Avalanche blockchain, was reported to have been hacked, resulting in the loss of $3.2 million. At the same time, this is also considered the first major hack in the Avalanche (AVAX) ecosystem.
Zabu Finance hacked, the first significant loss on the AVAX ecosystem
Specifically, on September 12, the Twitter page DeFiPrime announced that the Zabu Finance project lost $ 3.2 million in the first notable hack on the Avalanche (AVAX) blockchain. The details of the loss value summarized by DeFiPrime are as follows:
⚠️ @zabufinance $ZABU exploited ⚠️
Probably it is the first big exploit on #avalanche?
About $3.2M stolen:$WETH: 402.9$WAVAX: 23,157$PNG: 21,501$AVE: 106,848$USDT:361,267$JOE:23,958.93
— defiprime (@defiprime) September 12, 2021
On the Zabu Finance side, the project also quickly informed the community after the hack took place and provided some explanations. The project team said that funds could be stolen from their SPORE pool. At the same time, they also confirmed that they had not sold any ZABU yet.
We’ve been exploited today. What happened?
Everything was from a Pool of $SPORE Token -> https://t.co/D12H7uB5pD
Spore has Transfer Tax so that the attacker used the same mechanism with attacks explained on https://t.co/vXkCKPKBIz and https://t.co/SZiss6IC3R)
— Zabu Finance ? (@zabufinance) September 12, 2021
Based on further investigation, Zabu found the attacker stole the assets from a pool of Spore tokens which, according to the blockchain explorer, included 402.9 WETH, 23,157 WAVAX, 21,501 PNG, 106,848 AVE, 361,267 USDT, and 23,958.93 JOE, all amounting to $3.2 million at the time of exploit. It added that the attacker exploited the “Transfer Tax” mechanism of the protocol to mint tokens causing the price to collapse. The attacker manipulated a vulnerability in the contract used by yield farms to distribute rewards.
Zabu confirmed that the attacker could interact with the blockchain contracts and successfully pulled out 4.5 billion Zabu tokens from Zabu Farm Contract, dumped all to Pangolin LPs and Trader Joe LPs Zabu, stole around $600,000. Soon after the exploit, Zabu and an Avalanche-hosted DeFi tool, Yield Yak, advised investors to withdraw their holdings or risk losing their assets to the attacker.
Zabu intends to return tokens to investors based on their balances before and after the hack | Source: Zabu Finance
Zabu has also burned the remaining 93.12 million Zabu tokens, which were worth $360,000.
This event caused the ZABU price to collapse to zero (or close to it). While a day earlier, ZABU was still trading at $0.004, but after the attack, the price fell to $0.0002, or nearly 100% of its value. However, at press time, ZABU is up 35% again, trading at $0.00005256.
ZABU/USD 1-day chart | Source: TradingView
Read more:
- The Hacker Sent 5,152.6 ETH From Its Address To Cream Finance Multi-Sig Wallet
- 14 Suspects Behind Crypto Scam In Taiwan Arrested