The attacker injected money into multiple trading pairings.
Ola Finance reported it had been hacked for $3.6 million.
Inverse Finance (INV), an Ethereum-based lending system, said on Saturday that it had been hacked and that an attacker had made off with $15.6 million in cryptocurrencies. On Inverse’s Anchor (ANC) money market, a hacker was able to borrow money against very cheap collateral by fraudulently manipulating token values.
The third multi-million dollar DeFi breach in a week shows how attackers are becoming more creative in stealing money. First, there was a loss of more than $625 million for Ronin Network on Tuesday, then two days later, lending system Ola Finance reported it had been hacked for $3.6 million.
Inflated INV as Collateral
By exploiting a weakness in the Keep3r price oracle used by Inverse to monitor token prices, the Inverse attacker gained access to token prices. For example, when the oracle thought the price of Inverse’s INV token was inflated, the attacker took out multi-million-dollar loans on Anchor using the inflated INV as collateral.
To carry out the hack, the attacker first took 901 ETH (approximately $3 million) from Tornado Cash, a service that facilitates the transfer of crypto without leaving a trail of evidence. On the decentralized exchange SushiSwap, the attacker then injected the mysterious money into multiple trading pairings, inflating the price of INV in the Keep3r price oracle.
By raising the price of INV, the attacker was able to take out loans secured by INV on Anchor, which were quickly brought back to normal prices by arbitrageurs.A total of 73.5 ETH (about $250,000) remains in the attacker’s initial Ethereum wallet, even though most of the money has been cycled back via Tornado Cash. For now, all lending on Anchor has been suspended by Inverse.