Hackers siphon more than $8 million from the Moola Market DeFi protocol

Hackers attacked the Moola Market DeFi platform built on the Celo blockchain. The damage amounted to about $8.4 million across several tokens.

1/3

Today @Moola_Market has been exploited for $8.4M:

— 8.8M CELO ($6.5M)
— 765k cEUR ($0.7M)
— 1.8M MOO ($0.6M)
— 644k cUSD ($0.6M)

It was an incredibly simple attack👇 pic.twitter.com/mSRNaMBwQi

— Igor Igamberdiev (@FrankResearcher) October 18, 2022

“It was an incredibly simple attack,” commented the head of research at The Block Igor Igamberdiev.

Hackers moved 243,000 CELO into the protocol from Binance. They used the funds to borrow 1.8 million native MOO tokens. By artificially inflating the price of the coin, they were able to borrow against it to take out loans in other assets and withdraw them.

The Moola Market team paused the platform and began an investigation. It reached out to the attackers, warning that it had engaged law enforcement to block the liquidation of the stolen funds.

We are actively investigating an incident on @Moola_Market. All activity on Moola has been paused. Please do not trade mTokens.

To the exploiter, we have contacted law enforcement and taken steps to make it difficult to liquidate the funds. We are willing to negotiate a…

— Moola Market 🐮 (@Moola_Market) October 18, 2022

After this, unknown actors returned 93.1% of the withdrawn assets.

According to Igamberdiev’s estimates, the hackers left 700,000 CELO (~$0.5 million) as a bounty reward. From this amount they sent 50,000 tokens to the address of the fintech platform impactMarket.

5/3

It seems that in the end the exploiter got 700k CELO as a ‘bug bounty’

They already tried to move 50k of them to the multi-sig created by Impact Market pic.twitter.com/E6zr5PTj35

— Igor Igamberdiev (@FrankResearcher) October 18, 2022

“I can confirm that those 50K CELO were sold for cUSD and donated through impactMarket to support thousands of families from 30 developing countries living in vulnerability as unconditional basic income,” wrote the project’s founder Marco Barboza.

I can confirm that those 50K CELO were sold for cUSD and donated through @impactMarket_ to support thousands of families from 30+ developing countries living in vulnerability as unconditional basic income

— Marco | $PACT (@mbarrbosa) October 18, 2022

“We were not involved in this,” he clarified.

Despite the incident, the price of the MOO token rose by almost 18.5% in the last 24 hours, according to DEX Screener. However, the service warns of low liquidity for the asset.

As Chainalysis notes, October has already become a record month for the amount stolen in DeFi. By the 13th, following 11 attacks, hackers withdrawn from protocols $718 million, according to Chainalysis.

Follow ForkLog’s Bitcoin news on our Telegram — cryptocurrency news, prices and analysis.