Hacker Steals $3.2 Million From Avalanche-based DeFi Project

Reading Time: < 1 minute

Decentralized finance protocol (DeFi) Zabu Finance (Avalanche blockchain) has announced a hack. The price of the project’s native token ZABU has plummeted to zero following the incident.

Upon discovering the attack, the Zabu Finance team has turned to decentralized exchanges Pangolin and Trader Joe in the Avalanche ecosystem for help:

“Zabu Team Wallet has not sold a single Zabu. We’re under an exploit, possibly from Spore Pool. We’re investigating the exploit. Need help.”

An investigation has found out the attacker has stolen assets from Spore Pool. According to the blockchain explorer, he has stolen: 402,9 WETH, 23,157 WAVAX, 21,501 PNG, 106,848 AVE, 361,267 USDT and 23,958.93 JOE.

Zabu Finance has discovered a hacker has exploited a vulnerability in a smart contract and successfully withdrawn 4.5 billion ZABU, which he has sold on Pangolin and Trader Joe, for about $600,000.

Immediately after the attack, the project team has asked investors to withdraw their assets in order to avoid losses.

Zabu Finance plans to reimburse users based on a snapshot of their balances before and after the attack.