penpie

ChainCatcher news, Penpie stated that deposits and withdrawals on Penpie are still suspended as the platform is undergoing a comprehensive audit by multiple security firms to ensure a safe return to operations. BlockSec, PeckShield, and AstraSec have initiated the audit, and Penpie is in discussions with other companies. Deposits and withdrawals are expected to resume in about two to three weeks, pending the successful completion of these audits. Penpie will also collaborate with Hexagate to integrate real-time monitoring and establish an efficient, proactive response system. Penpie continues to work closely with law enforcement, security firms, partners, and key members of the crypto community (including major exchanges) to trace and freeze funds related to the hack.Additionally, Penpie is taking steps to prepare a post on the Penpie governance forum to discuss a potential compensation plan.Previous news, on September 4, Penpie was hacked, resulting in the theft of 11,113.6 ETH, valued at approximately 27.34 million USD.

ChainCatcher news, according to on-chain analyst Yu Jin's monitoring, the Penpie hacker deposited the last 1,661 ETH into Tornado Cash 3 hours ago. This means that all of the $27 million in assets (approximately 11,261 ETH) stolen from Penpie by the hacker have been transferred through Tornado Cash.

ChainCatcher message: According to the latest statistics from blockchain security company Certik, there have been 8 reentrancy attack incidents from the beginning of 2024 to date, resulting in a total loss of approximately 30 million dollars. Among them, the attack on Penpie has become the largest reentrancy attack incident of 2024, and it is also the third largest reentrancy attack since January 2021.In terms of loss scale, the Penpie attack is second only to the Grim Finance attack that occurred in December 2021 (with losses of approximately 40 million dollars) and the Vyper vulnerability incident in July 2023 (with losses of approximately 52 million dollars).

ChainCatcher news, the decentralized finance platform Penpie announced a bounty reward of up to 10% of the recovered funds for key information providers that assist in identifying the attackers and recovering the stolen funds. This move aims to mobilize the collective expertise of the cryptocurrency community to restore platform security and rebuild market confidence.Previous news, Penpie suffered a hack, with customer fund losses of approximately 27 million dollars.

ChainCatcher news, according to on-chain data, the hacker who stole $197 million in assets from Euler Finance last March left a message on-chain praising the Penpie hacker for their "non-cooperation with the project team to return the stolen funds."

ChainCatcher message, according to CertiK Alert monitoring, the Penpie attackers have transferred 9,600 ETH (approximately 23 million USD) to Tornado Cash through multiple addresses.

ChainCatcher news, Penpie has released a report on the hacking incident, with a total of approximately $27.34 million worth of 11,113.6 ETH stolen. The attacker exploited a security vulnerability on the Penpie platform by manipulating a fake Pendle market to maximize rewards. The vulnerability is located in the batchHarvestMarketRewards() function of the PendleStakingBaseUpg contract, where the attacker manipulated the reward tokens and their quantities by re-entering the depositMarket() function and repeatedly adding new deposits from flash loans. The Penpie team responded quickly, suspending deposit and withdrawal functions, and collaborating with multiple security agencies to trace the stolen funds.Currently, the Penpie frontend has been restored, and the team is working with law enforcement to identify and apprehend the attacker. Additionally, the Penpie team is developing a compensation plan to fairly address the losses of affected users.

ChainCatcher message, according to monitoring by Shield, the Penpie attacker marked address (with a balance of 7100 ETH) has again transferred 1000 ETH (approximately 2.4 million USD) to an address starting with 0xD440, which then transferred 100 ETH to Tornado Cash.

ChainCatcher message, the stablecoin protocol Usual stated that its USD0 pool was not affected by the Penpie hacking incident.

ChainCatcher news, according to monitoring by Shield, the Penpie hacker has transferred another 1,900 ETH to Tornado Cash, approximately 4.5 million USD.The Penpie attacker has marked addresses that have cumulatively transferred 2,900 ETH (approximately 6.9 million USD) to TornadoCash.

ChainCatcher message, Pendle official released an analysis of the Penpie attack incident on the X platform.Earlier today, a security vulnerability targeting Penpie resulted in some fund losses. In response, Pendle quickly suspended the contract, effectively protecting approximately $105 million. After extensive efforts, the Pendle contract has now been restored and is operating normally. Funds on Pendle remain secure.The Pendle team assures that funds on Pendle are still safe and unaffected, and will continue to prioritize the secure operation of the platform.

ChainCatcher news, according to Beosin Alert monitoring, the DeFi protocol Penpie built on Pendle has been hacked, resulting in the theft of approximately $27 million in crypto assets. Beosin provides the following brief analysis of the incident:The attacker exploited the claimRewards function in the market contract to re-enter the staking contract, increasing the staking contract balance, and then withdrew excess tokens and staked assets from the taking contract for profit.The attacker first created an attack contract and constructed the corresponding market contract through the official factory.Called the batchHarvestMarketRewards function of the staking contract to update rewards for the market.During the reward update, the attack contract's claimRewards function is called back, allowing for re-entry to stake the assets obtained from the flash loan, creating a discrepancy in the asset quantity of the staking contract, and withdrawing the excess.The attacker withdrew the staked assets and repaid the flash loan for profit.

ChainCatcher news, Pendle yield enhancement protocol Equilibria stated on platform X that Equilibria's own assets are secure, the contract code (different from Penpie), adding Pendle market pools on Equilibria requires approval authority from the core team, and there is a 7-day waiting period for reward distribution.

ChainCatcher news reports that the decentralized finance protocol Penpie has been hacked, with total losses reaching 27.3 million dollars, according to monitoring by Lookonchain. Based on on-chain data analysis, the stolen assets include:2,695 rswETH, worth approximately 6.62 million dollars;4,101 agETH, worth approximately 10.17 million dollars;2,723 wstETH, worth approximately 7.77 million dollars;2.52 million sUSDe, worth approximately 2.77 million dollars;The attacker subsequently exchanged all the stolen assets for 11,109 ETH, with a total value of approximately 27 million dollars. Notably, the hacker has deposited 1,000 ETH (approximately 2.34 million dollars) into the anonymous mixing protocol Tornado Cash.

ChainCatcher news, according to official information, Pendle has announced that all contract operations have resumed, and trading is now back to normal. The security vulnerability was limited to Penpie, and the funds on Pendle are safe.The Penpie team is currently drafting a post-mortem report, which will be released soon to provide more details.

According to ChainCatcher news, PeckShield monitoring shows that the Penpie attacker-tagged address has transferred 1,000 ETH (worth about 2.44 million USD) to Tornado Cash, while approximately 10,110 stolen ETH (worth about 24.7 million USD) remains at the address starting with 0x2f2d.

ChainCatcher news: Penpie, an independent decentralized finance protocol built on Pendle, was hacked this morning, resulting in a customer fund loss of approximately $27 million.Previously, Penpie had suspended all deposit and withdrawal operations, and a Pendle spokesperson confirmed that customer funds are safe, suspending all contracts until the issue is resolved.According to an Immunfi report, over $1.2 billion has been stolen through 154 hacking and exploitation incidents in 2024 alone. Immunefi founder and CEO Mitchell Amador stated that while most vulnerabilities occur in the DeFi space, vulnerabilities in CeFi infrastructure have caused the largest economic losses.A report from PeckShield indicated that losses from hacking attacks in August 2024 exceeded $313 million, with two major attacks stealing approximately $238 million in Bitcoin and $55 million in Dai.A report from Scam Sniffer noted that losses from phishing attacks surged by 215% in August 2024, with a single attack stealing $55 million.