Inverse Finance suffers new attack

The decentralized finance (DeFi) protocol Inverse Finance suffered a new exploit on Thursday (16). The protocol attack resulted in losses of about $1.2 million. 

Inverse Finance suffered exploit again

The attack comes about two months after the protocol suffered another exploit that resulted in losses of more than $14.2 million.

In the April attack was an intensive capital manipulation of the INV/ETH price oracle on the Sushiswap platform. This resulted in a sharp rise in the price of the native INV token.

This time, a malicious actor executed a flash loan attack using 27,000 Wrapped Bitcoins, valued at around $580 million.

“Flash Loan” are loans that require repayment of the amount borrowed in the same transaction. This is only possible due to smart contract technology.

In a flash loan attack, the exploiter often uses manipulation techniques to cause the price to fall or rise.

However, it is also possible to use the mechanism to divert funds from projects, manipulating the price data feeds – the oracles – and carrying out explorations.

DeFi protocol attack details

In the case of Inverse Finance, the explorer managed to drain 53 BTC and 100,000 USDT. According to blockchain security firm PeckShield, hacker sent the funds to Tornado Cash, a popular transaction mixer on the ETH network that helps hide the origin of the funds.

As PeckShield reported, the protocol loss could be more than the sum of $1.2 million.

“The hack is possible due to the manipulation of the price oracle, which uses asset balances in the pool to directly calculate the price of the LP token. It is very easy to skew the reserves in the pool with a flash loan,” PeckShield said.

The Inverse confirmed the attack on its Twitter account and said it temporarily stopped lending after the incident. In addition, he stated that he is investigating the case:

“We are investigating the incident. But no user funds have been withdrawn or are at risk. We are investigating and will provide more details soon.”