$371K in USDC stolen in an Avalanche flash loan exploit

Avalanche-based lending protocol Nereus Finance was hacked and $371K in USD Coin (USDC) was stolen. The hacker deployed a custom smart contract taking advantage of a $51 million flash loan from Aave.

CertiK, a blockchain cybersecurity firm, was among the first to detect the hack on September 6. CertiK at the time said that the exploit impacted liquidity pools relating to decentralized exchange Trader Joe and automated market maker Curve Finance on Nereus

But Curve Finance responded on September 7 arguing that maybe CertiK was referring to ‘assets impacted’ rather than protocols impacted since only Nereus Finance and its assets seemed affected by the exploit.

Post-mortem of the exploit

On September 7, Nereus Finance released a comprehensive post-mortem of the exploit saying that the hacker was able to deploy a custom smart contract targeting a $51 million flash loan from Aave to manipulate the price of AVAX/USDC Trader Joe LP pool for a single block.

Consequently, the hacker was able to mint 998,000 NXUSD, Nereus’ native token, using collateral worth $508,000. The hacker then swapped the minted NXUSD into different assets through several liquidity pools and managed to walk away with a net profit of $371,406 after the flash loan was returned.

While the hacker made a profit, the exploit created $508,000 worth of NXUSD ‘bad debt.’

Nereus was however quick to arrest the situation by developing a mitigation plan, notifying law enforcement, and then liquidating and pausing the exploited JLP pool. The NXUSD bad debt was paid off using the protocol’s treasury.

Nereus also noted that a similar exploit will not be possible in future since the protocol will amend its audit and security practices. Nereus noted:

“While this exploit is a bad incident – it’s not uncommon for protocols to face these types of battle tests.”

As of the time of writing, the Nereus team was still trying to identify the hacker by tracking the funds. It has offered a 20% White Hat reward for the return of the funds with no questions asked.

All Dutch and English crypto news!

Is Helium on track for its biggest daily gain this month after rallying by more than 7% today?

HNT is on track for its biggest gain this month as Helium is outperforming the other coins in the top 100.   HNT, the native token of...

Is the Baby Doge a good buy in October?

Baby Doge price has been a bit volatile in the past few days as investors buy the coin's dip. The token surged to a high...

Michael Saylor snubs claims he doesn’t use Bitcoin Lightning Network

The executive chairman of MicroStrategy, Michael Saylor, does not like to be called out. He responded to a poll shared by Eric Wall, a crypto...

Bitcoin still has $14K target, warns trader as DXY due ‘parabola’ break

Bitcoin (BTC) held $20,000 into Oct. 5 with trader targets still including a fresh high before rejection. BTC/USD 1-hour candle chart (Bitstamp). Source: TradingView $21,000 upside target...

Beste exchanges

Koop je crypto bij Bitvavo