Indexed Finance team claims to have identified the hacker who stole $16 million.

The team behind the Indexed Finance DeFi project says it has identified the attacker who siphoned assets worth approximately $16 million from the protocol.

Indexed Finance provides users access to crypto-industry-focused digital indices. These instruments are ERC-20 tokens, listed in liquidity pools managed by a Balancer protocol fork.

On October 15, the attacker exploited a vulnerability in the project’s liquidity-pool rebalancing mechanism. The attack affected two index tokens — DEFI5 and CC10. To execute it, the attacker used flash loans.

On October 16, the protocol developers issued an ultimatum. They gave him until the end of the day to return the funds and threatened, if not, to publish his information and notify law enforcement.

The attacker did not return the funds by the deadline, but the Indexed Finance team did not carry out its threats either. The developers explained that changes the hacker made to the account led them to conclude that he was considerably younger than they had thought.

Indexed Finance team member Lawrence Day told Decrypt that, in addition to DEFI5 and CC10, another asset — the meta-index FFF — was affected.

According to Day, the token in its current form will have to be liquidated. The project is developing a plan to compensate users.

On October 17, the alleged hacker under the alias ZetaZeroes wrote that someone copied his attack and withdrew $5 million worth of assets from the FFF pool.

He described his actions as arbitrage and expressed doubts about the Indexed Finance team’s disclosure of his identity.

«You’ve screwed up. Nothing you can do. If you and your liquidity providers had taken the time and effort to better understand Balancer pools, you could have prevented this and even outperformed me», — wrote he.

Back in September, the hacker of the Cream Finance DeFi protocol returned most of the stolen assets worth about $18 million.

Follow ForkLog news on Facebook.