Decentralized Finance marketplace Deus Finance has lost $13.4 million following a flash loan hack on Thursday at 2.40 AM UTC.
The hackers manipulated the DeFi price data feed called oracles on the flash loans, which are usually meant for arbitrage and enhancing capital efficiency.
Blockchain security company PeckShield explains that the bad actors took a flash loan to alter the price of oracle in one of its liquidity pools based on Fantom. The token involved was DEI, paired with the USDC stablecoin.
The security audit explains that the manipulation caused the price of DEI to increase significantly, which was then used as collateral to borrow more capital within the same flash loan.
The additional borrowed funds were exchanged for USDC stablecoin, and then the hackers repaid the loan, getting $13.4 million.
The stolen funds were transferred from Fantom to Ethereum through Tornado Cash, a mixed protocol used for obfuscating Ethereum transactions.
Flash loans are blockchain-based loans that must be repaid in the same transaction and are managed using smart contracts.
Source: THE BLOCK