Decentralized exchange Velocore suffered almost $7 million in hacking
Date: 2024-06-03 Author: Gabriel Deangelo Categories: BLOCKCHAIN
On June 2, 2024, the decentralized exchange Velocore, operating on the zkSync Era, Telos and Linea blockchains, was subject to a hacker attack, as a result of which $6.8 million in Ethereum was stolen. The main reason for the hack was a vulnerability in the smart contract.
Vulnerability in smart contract
The Velocore team reported that the attack was possible due to “faulty logic in the ConstantProductPool function ‘velocore__execute()’.” The hacker used an attack method using flash loans, which led to significant losses in all Velocore volatile pools on the Linea and zkSync Era networks. A vulnerability was also discovered on the Telos blockchain, but it was patched before an attacker could exploit it.
Actions of the attacker
The hacker received funds from the Tornado Cash mixer, performed an exploit, transferred the funds through Across Bridge, and then returned them back to Tornado Cash. The Linea team has temporarily suspended the sequencer on two units to protect users. Velocore and Linea asked centralized exchanges to freeze the stolen funds.
Velocore team reaction
The Velocore team expressed deep regret over the incident: “Despite numerous audits and implementation of preventative security measures, this unexpected incident occurred rapidly. We are deeply upset and apologize to the users who trusted us."
Proposal to a hacker
Velocore offered the attacker to return 90% of the stolen funds for a reward of 10% until June 3, 2024, 08:00 UTC. The exchange also announced plans to compensate users once operations resume.
This incident highlights the importance of security in decentralized finance. Despite preventive measures and audits, vulnerabilities in smart contracts remain a serious threat. Earlier it was reported that the Japanese crypto exchange DMM Bitcoin was hacked, as a result of which $303 million was stolen, which indicates ongoing risks in the cryptosphere.
