Decentralized leverage trading platform on Avalanche, Defrost finance reported that all the funds lost due to an exploit on its platform on Dec. 23 were returned on Dec. 26 after claims of a possible rug pull.
The hacked funds have been returned to #DefrostFinance.
The affected users will very soon be able to claim their assets back.
Details
https://t.co/RpDqKAK44y
— Defrost Finance
(@Defrost_Finance) December 26, 2022
Defrost Finance affirmed that it would return all the lost funds to the exploited users after scanning the on-chain data to determine the ownership and amount of funds owned by each affected user.
Earlier, the Avalanche-based protocol reported the platform had been hacked, with an attacker withdrawing funds using the flash loan function.
On Dec.24, the firm claimed that only their V2 product was affected, and V1 remained safe.
Defrost Finance is sad to announce that our V2 has suffered a hack, with an attacker using a flash loan function to withdraw funds.
The V1 is not affected. We will soon close the V2 UI and investigate further with our tech team.
Updates will be posted on our official channels.
— Defrost Finance
However, on Dec. 25, the team reported the hacker also obtained the owner key for a larger attack on the platform’s V1 product.
The hacker made almost $173k from the exploit, according to blockchain analytics firm PeckShield.
The @Defrost_Finance is exploited, leading to the gain of ~$173k for the hacker. The hack is made possible due to the lack of reentrancy lock for the flashloan()/deposit() functions, which was used by the hacker to manipulate the share price of LSWUSDC. pic.twitter.com/SINHUZXC0D
— PeckShieldAlert (@PeckShieldAlert) December 23, 2022
Upon further analysis, PeckShield revealed that a fake collateral token was added. A malicious price oracle was used to liquidate current users for a total loss of more than $12 million, indicating a possible rug pull.
Further, blockchain security firm Certik claimed that the exploit was an exit scam after they couldn’t get any response to their queries from Defrost Finance team.
On 24 December we have seen an #exitscam on @Defrost_Finance
We have attempted to contact multiple members of the team but have had no response.
The team are not KYC’d but we are using all the information that we do have to assist with authorities pic.twitter.com/XC009dM40T
— CertiK Alert (@CertiKAlert) December 26, 2022
On the same note, DeFiYieldApp, a Web3 security firm, tweeted that they warned the DeFi Community one year ago about the Defrost Finance smart contract vulnerability that allows the firm to rugpull its users.
Even though there are no clear indications whether the hack was a rug pull, the firm has shown a willingness to negotiate with the hackers to return funds.
On Dec. 25, the total value of funds locked on the protocol had dropped to less than $93,000 from $13.16 million after the attack, according to DefiLlama data.
Read More: cryptoslate.com
Bitcoin 
Ethereum 
Tether 
XRP 
BNB 
Solana 
USDC 
Dogecoin 
Cardano 
TRON 
Lido Staked Ether 
Wrapped Bitcoin 
Sui 
Wrapped stETH 
Chainlink 
Avalanche 
Hyperliquid 
Stellar 
Shiba Inu 
Hedera 
LEO Token 
Bitcoin Cash 
Toncoin 
Litecoin 
Polkadot 
WETH 
USDS 
Monero 
Wrapped eETH 
Bitget Token 
Binance Bridged USDT (BNB Smart Chain) 
Pepe 
Pi Network 
Ethena USDe 
Coinbase Wrapped BTC 
WhiteBIT Coin 
Aave 
Uniswap 
Bittensor 
Dai 
NEAR Protocol 
Aptos 
OKB 
Jito Staked SOL 
Ondo 
Official Trump 
Kaspa 
Cronos 
BlackRock USD Institutional Digital Liquidity Fund 
Tokenize Xchange