DeFi Digest: TVL Dips Below $40 Billion as Exactly Protocol Hacked for $12 Million

The DeFi sector continues to attract heightened attention from cryptocurrency investors. ForkLog has compiled the most important events and news of the past weeks in a digest.

Key DeFi metrics

Total value locked (TVL) in DeFi protocols fell to $37.75 billion. Lido led with $13.96 billion, while the second and third spots were held by MakerDAO ($5 billion) and AAVE ($4.5 billion), respectively.

TVL in Ethereum applications fell to $21.77 billion. Trading volume on decentralized exchanges (DEX) over the last 30 days stood at $46.5 billion.

Uniswap continues to dominate the market for non-custodial exchanges — accounting for 57.7% of total trading volume. The second DEX by trading volume is PancakeSwap (17.2%), the third is Curve (6.3%).

DeFi project Exactly Protocol hacked for $12 million

On August 18, a hacker hacked the lending protocol Exactly Protocol on layer-2 network Optimism and withdrew more than 7,160 ETH (~$12 million at the time of writing).

According to analytics firm De.Fi, the attacker exploited a vulnerability in an Ethereum smart contract. The exploit involved moving deposits from the mainnet to Optimism, and then back.

The attacker withdrew funds in three transactions of 910 ETH, 226,731 USDC and another 2.64 million USDC. Experts suggested that additional stolen assets may be discovered in the future.

The hacker has already transferred 1,500 ETH (~$2.5 million) across the bridge using Across Protocol.

DeFi protocol Zunami loses $2.1 million in exploit

The yield aggregator Zunami Protocol was hacked, as a result of which it lost digital assets worth $2.1 million.

PeckShield analysts noted that the attack occurred due to price manipulation, causing an incorrect calculation of asset prices. According to experts, the hacker has already sent the stolen funds to the mixer Tornado Cash.

Representatives said that the attack occurred on the protocol stablecoins zStables. The Zunami team recommended temporarily refraining from purchasing zETH and UZD.

Base platform RocketSwap lost $870,000 due to key leakage

The DeFi liquidity protocol RocketSwap on the L2 network Base was attacked, as a result the attacker withdrew around 471 ETH (~$870,000 at the time of writing).

“As a result of the investigation, we regret to inform you that the team had to use offline signatures when deploying the launchpad and placing private keys on the server,” the developers said.

Representatives noted that the proxy-server breach occurred via brute force — that is, by simply trying multiple options.

Thanks to the exploit, the hacker minted 90 trillion LoveRCKT tokens, before transferring them to Uniswap. The protocol halted farming pools to prevent further damage.

Also on ForkLog:

• Balancer urged users to withdraw funds from pools.
• SwirlLend carried out a rug pull worth $460,000.
• BlockTower backed Maple Finance in a $5 million funding round.
• Compound integrated the Base L2 network from Coinbase.

“