DeFi’s $2M Meltdown: Tornado Cash Strikes Again! 😂

by

Ah, what a day in the land of decentralized finance (DeFi)! The New Gold Protocol (NGP) fell prey to a lovely little exploit on Wednesday, with almost $2 million worth of assets drained from its liquidity pool. And where did all that sweet stolen cash go? Tornado Cash, of course, the magical black hole where funds go to disappear, never to be seen again. 🔥💸

So, how did it happen? Let’s break it down

According to the sharp minds at Web3 security firm Blockaid, the attacker found a nice juicy flaw in NGP’s getPrice() function-a function that decides how much NGP tokens are worth based on the reserves in a Uniswap V2 pool. Apparently, relying on a single pool for price data is like leaving your front door wide open at night. 😬

Blockaid said, “A spot price from a single DEX pool is insecure because an attacker can easily and dramatically manipulate the pool’s reserves with a single flash loan.” Sounds like an invitation for mischief, right? 🕵️‍♂️

The attacker, with the elegance of a well-dressed thief, initiated a flash loan, borrowed a bunch of tokens, and manipulated the mainPair pool by increasing the USDT reserve while draining NGP tokens. This clever move made the getPrice() function show NGP tokens were worth much less than they actually were. Who says crime doesn’t pay? 😎

And then, the aftermath… Spoiler: It’s not good

Once the tokens were safely in the attacker’s hands, they swapped them into Ethereum and sent them through Tornado Cash, effectively making the trail vanish like Houdini’s best trick. Poof! 💨

News of the hack spread faster than a celebrity scandal, leaving the DeFi community in a panic. NGP’s token price plummeted, investors were left holding their bags, and, unsurprisingly, NGP has yet to announce any plan to reimburse the victims. It’s like they left town with the money and didn’t even send a postcard. 🏃‍♂️💨

Lessons learned? Probably not…

The NGP hack is a glaring reminder of how risky it is to rely on a single-price source. Flash loans continue to be a favorite tool for bad actors, who can exploit the vulnerabilities of these protocols with disturbing ease. 💀

Experts are now screaming from the rooftops, suggesting that DeFi projects should use multiple price feeds, conduct regular audits, and secure their contracts better. But let’s be real, how many projects actually listen? 🤷‍♀️

And the cherry on top? This $2 million loss joins the ever-growing list of DeFi hacks this year. Just recently, the Nemo Protocol lost $2.6M after an unaudited code made its way to the mainnet. Flash loan exploits continue to be the flavor of the season. 🍦

So, here’s the takeaway: DeFi is still like the Wild West of finance, with security being the weakest link. Builders and investors alike, buckle up, because it’s a bumpy ride ahead! 🎢

Read More

2025-09-18 18:30