DeFi Protocol Zunami Suffers $2.1 Million Loss in Liquidity Pool Attack

DeFi platform Zunami Protocol has fallen victim to an attack on its liquidity pool within the Curve Finance platform, resulting in a substantial loss of over $2.1 million.

Notable blockchain security firms, PeckShield and Ironblocks, were swift in reporting this security breach.

Operating as a decentralized autonomous organization (DAO), the Zunami Protocol operates as a yield farming aggregator with a significant focus on stablecoin staking.

The primary "zStables" pool, based on the Ethereum blockchain, facilitates the decentralized exchange (DEX) of stablecoins.

How Did the Hacker Attack Zunami Protocol?

The attacker executed a flash loan from the balancer, subsequently adding liquidity to have the ability to significantly manipulate the price, which was employed for trading within the Zunami's exchange.

The attacker then proceeded to remove the liquidity and alter the price, following which, the flash loan was returned, allowing the individual to claim a considerable amount of 1,152 ETH.

Another respected entity in blockchain analysis, PeckShield, which has been vigilant in tracking attacks on the Curve platform, also identified the Zunami attack and promptly notified the protocol via Twitter.

The specifics of the hack reveal a price manipulation vulnerability, which was exploited by manipulating the price calculations.

The Aftermath of the Zunami Hack

Zunami addressed the situation on Twitter, confirming the attack on their zStables platform.

Zunami also cautioned against purchasing zETH and UZD tokens at the moment due to the attack affecting their emission.

The ill-gotten funds from the attack have already been laundered through the controversial coin mixing service known as Tornado Cash, as reported by the affected firm.