Hackers used LP vulnerability to steal $5 million from Osmosis transaction, some hackers quickly returned $2 million

Osmosis, a decentralized exchange (DEX) built on the Cosmos network, was shut down just before 3 a.m. ET on Wednesday after attackers exploited a liquidity provider (LP) vulnerability and stole about 5 million Dollar.

The vulnerability was first discovered in a thread on the official Cosmos Network page on Reddit. The user, Straight-Hat3855, drew attention to a “serious problem” with Osmosis (OSMO), which allows users to arbitrarily increase their LPs by 50% simply by adding and removing liquidity. The post on Reddit was quickly deleted, but not before malicious actors exploited the vulnerability, resulting in the theft of roughly $5 million from the Osmosis exchange’s liquidity pool.

According to the announcement of Mintscan, the Osmosis blockchain browser, the Osmosis exchange stopped at block height 4,713,064 after the vulnerability was exploited and the LP vulnerability was identified.

Project administrator RoboMcGobo explained how the vulnerability works in a series of posts on the Osmosis Discord. He detailed how the bug would have allowed attackers to add liquidity to any Osmosis LP, then instantly withdraw it and receive a 150% return on their initial deposit.

RoboMcGobo wrote just after 4 p.m. on Wednesday: "Essentially, the feature gives 50% more LP shares to join," adding: "If a person should get 10 LP shares, then he You'll end up with 15 copies."

RoboMcGobo explained that the vulnerability was "intentionally exploited by a small number of users" and "appears to be unintentionally exploited by a small number of users." According to a tweet from Osmosis, 4 hackers accounted for 95% of the total attack volume, and 2 of the attackers voluntarily returned the stolen funds.

About an hour after Osmosis tweeted about the attack, FireStake, a validator for the Cosmos ecosystem, admitted on Twitter that a "momentary lapse in judgment" had resulted in two members of his team exploiting the bug to gain roughly $2 million income.

Firestake told their 1,700 Twitter followers that they were "thinking about [their] family's future" as they continued to exploit the loophole. However, after admitting to being "nervous all night" about the matter, they decided to voluntarily return the funds and "solve the issue".

According to a post by Osmosis co-founder Sunny Aggarwal, two other hackers made a series of transactions on the centralized exchange, which Aggarwal believes will make it easier to track them down.

RoboMcGobo echoed Aggarwal's claim on the project's Discord, "The funds were linked to the CEX account. We have notified law enforcement...We hope these attackers make the right decision so that aggressive action is not necessary."