Inverse Finance DeFi Lender Exploited For $15.6M

Inverse Finance DEFI lender exploited for $15.6 million and this Is the third multimillion-dollar attack to make headlines in the past few days as we can see more today in our latest cryptocurrency news.

The Ethereum-based lending protocol Inverse Finance defi lender said that it suffered an exploit with an attacker netting up to $15 million worth of stolen crypto and accoridng to Inverse, the attacker targeted its Anchor money market which artificially manipulating token prices to borrow the loans against low collateral. This is the third multi-million dollar hack of DEFI protocol to make headlines and it underscores the sophisticated techniques thata are being used by the attackers. The gaming-focused Ronin network announced a loss of $625 million in crypto and then two days later the lending propofol OLA Finance said it got exploited for $3.6 million according to the Peckshield with the Inverse attacker taking advantage of the vulnerability in Keep3r price oracle that it uses to track the token prices. The attacker tricked the oracle into thinking that the price of Inverse’s INV tokens was quite high and then took out loans on Anchor using the inflated INV as collateral.

This morning Inverse Finance’s money market, Anchor, was subject to a capital-intensive manipulation of the INV/ETH price oracle on Sushiswap, resulting in a sharp rise in the price of INV which subsequently enabled the attacker to borrow $15.6 million in DOLA, ETH, WBTC, & YFI

— Inverse+ (@InverseFinance) April 2, 2022

The attack was well-financed so in order to pull it off, the attacker withdrew 901 ETH from tornado Cash and it is used to distribute crypto without leaving a trail. The attacker then injected the mystery funds into a few trading pairs on the decentralized exchange SushiSwap inflating the price of INV in the price oracle. With the price of the token being quite high, the attacker took out the INV-backed loans on Anchor before the arbitrageurs brought the price of the token to a normal level.

A representative from PeckShiled said the attack was high-risk since the $3 million worth of crypto used to trick the price oracle will be Los it the price of INV dropped back to normal levels before the attacker took out the loans. The attacker then managed to run away with 1588 ETH, 94 WBTC, and 39 YFI. The attacker cycled most to shift funds via Tornado Cash whcih means it is quite difficult to know where the funds will end but about 73.5 ETH remained in the attacker’s original ETH Wallet. Inverse said in the announcement that it paused the borrowing on Anchor and one representative said that it’s working with Chainlink to build the new INV oracle.

The manipulation was not a flash loan attack and was un-related to Inverse’s smart contract or front end code. All future borrows on Anchor are temporarily paused. Some additional updates:

— Inverse+ (@InverseFinance) April 2, 2022

Inverse announced that it plans to make the proposal to the decentralized autonomous organization to ensure the wallets impacted the price manipulation being repaired 100% without providing more details.