DFX Finance Hacked for $4M – Attacker Moves Funds Through Tornado Cash

let atwWrapper,atwContainerWidth,atwSliderBox,atwTotalWidth; function initATWSlider() { atwWrapper = $('.relatedInstruments'); atwSliderBox = atwWrapper.find('.slider'); atwContainerWidth = atwWrapper.width(); atwTotalWidth = atwSliderBox.width(); if(window.domainId === '2' || window.domainId === '3'){ atwWrapper.find('.sliderRight').addClass('js-slider-prev'); atwWrapper.find('.sliderLeft').addClass('js-slider-next'); } else { atwWrapper.find('.sliderRight').addClass('js-slider-next'); atwWrapper.find('.sliderLeft').addClass('js-slider-prev'); } if(atwSliderBox.find('.instrumentBox').length > 6){ atwWrapper.find('.js-slider-next').fadeIn(600); } } function atwMoveRight() { atwWrapper.find('.js-slider-prev').fadeIn(150); $(".slider > :visible:first").hide(150) $(".slider > :visible:last").next().show(150); if(!$(".slider > :visible:last").next().find('.name')()){ atwWrapper.find('.js-slider-next').fadeOut(150); return; } } function atwMoveLeft() { atwWrapper.find('.js-slider-next').fadeIn(150); $(".slider > :visible:last").hide(150); $(".slider > :visible:first").prev().show(150); if(!$(".slider > :visible:first").prev().find('.name')()){ atwWrapper.find('.js-slider-prev').fadeOut(150); return; } } initATWSlider(); //update star icon on adding/removing instrument to/from specific watchlist atwWrapper.on('click', 'label.addRow', function() { let parent = $(this).parent(); let checkedPortfolio = false; parent.find('input[type=checkbox]').each(function () { if($(this).is(':checked')){ checkedPortfolio = true; } }); let closestStar = $(this).closest('.addToPortWrapper').find('.star'); if(checkedPortfolio){ closestStar.addClass('added'); }else{ closestStar.removeClass('added'); } }); //update star icon on creating new watchlist atwWrapper.find('.js-create-watchlist-portfolio').find('a.js-create').on('click',function () { let parent = $(this).parent(); let watchlistName = parent.find('input[type=text]').val(); if(!watchlistName){ return; } let star = $(this).closest('.addToPortWrapper').find('.star'); star.addClass('added'); }); //update star icon on adding new position atwWrapper.find('.js-create-holdings-portfolio').find('.js-submit').on('click',function () { let addPositionForm = $(this).closest('.addToPortfolioPop').find('.holdingsContent'); let amount = addPositionForm.find('.js-amount').val(); if(amount < 1){ return; } let star = $(this).closest('.addToPortWrapper').find('.star'); star.addClass('added'); }); atwWrapper.find('.instrumentBox').find('.shortInfo').on('click',function () { if(!window.ga){ return; } let pairId = $(this).parent().find('.js-add-to-portfolio').attr('data-pair-id'); let pairType = window.atwPairTypes[pairId]; window.ga('allSitesTracker.send', 'event', 'content', 'symbol link clicked', '', { "dimension147":"symbol_link_clicked", "dimension163":"click", "dimension148":"symbol", "dimension162":"content add to watchlist", "dimension161":"article page", "dimension142":"article", "dimension75":pairType, "dimension138":pairId, "dimension118":"2942106" }); window.open($(this).attr('data-href')); }); window.atwPairTypes = {"1058142":"currency","1172292":"Equities"};

• A hacker has stolen approximately 3,000 ETH, worth around $4 million USD, from DFX Finance’s Polygon liquidity pools.
• An MEV bot extracted a large sum of stolen funds.
• The decentralized exchange is set to shut down its liquidity pools on Polygon.
• The value of DFX crashed 34% following the news.

Stablecoin-focused decentralized exchange DFX Finance (DFX) suffered an attack on Friday, November 11th, resulting in the loss of $4 million in stolen funds.

PeckShield, a blockchain security firm, tweeted early on Friday morning that a hacker had managed to siphon an approximate 3,000 ETH, worth around $4 million USD at the time of writing, due to a “lack of proper reentrancy protection”.

DFX Finance confirmed the hack, stating that it was notified of suspicious activity within 20-30 minutes of the initial transaction, and swiftly executed “a pause on all DFX contracts within a few minutes after confirming the attack”.

The price of the exchange’s native token, DFX, plummeted as the news came to light. The token is currently trading at $0.17 at the time of writing, representing a 34% deficit ove the last 24 hours, and a 99% drop from its all-time high of $24.87, according to data from CoinGecko.

DFX Finance claims that the hacker moved the illicit funds through Tornado Cash, an Ethereum-based mixer that was sanctioned by the U.S. government earlier this year. The exchange also revealed that an MEV bot was able to intercept and extract a large sum of the stolen funds, and has asked that the owner of the bot get in touch with them.

The exchange further noted that Polygon contracts have proven particularly susceptible to such attacks, and announced its intention to shut down its related pools. DFX will reportedly enable a temporary withdraw-only mode while it asks Polygon LP holders to withdraw their funds.

DFX Finance focuses primarily on stablecoin trading. The platform offers liquidity mining and other features with non-U.S. stablecoins such as the Canadian dollar-pegged CADC, the eeuro-based EURS, and the Singapore dollar-pegged XSGD.

The decentralized exchange has strong backing, with investment from industry giants like Polychain Capital, Hex Capital, and CMS Holdings, among others.

2022 has proven to be a rough year for the project, which held a role in the Coinbase (NASDAQ:COIN) insider trading controversy, before subsequently being deemed a security by the U.S. Securities and Exchange Commission (SEC).

The attack on DFX Finance is just one of many to have occured over the last couple of months. In October, Mango Markets, a Solana-based decentralized exchange, saw $114 million stolen from its reserves, while TempleDAO, a yield-farming DeFi protocol built on Ethereum, lost $2.4 million, and Binance was drained off $100 million. Bitkeep, a multichain crypto wallet, also lost $1 million to hackers in what has since become the worst month of exploits in crypto history.

Chainalysis, a blockchain research platform, estimates that hackers stole more than $718 million in the first two weeks of October alone.

On the Flipside

• While unlikely, it’s possible that the hacker will return at least a portion of the stolen funds.
• The owner of the MEV bot may yet return some of the intercepted funds.

Why You Should Care

Attacks on decentralized exchanges have shown no signs of stopping this year. As always, users should do their due diligence to determine which platforms and exchanges are trustworthy enough, and offer high enough standards of security to hold their funds on.

You Might Also Like:

Deribit Hackers Move Stolen ETH to Blacklisted Mixing Service, Tornado Cash

See original on DailyCoin