MEV bot nets $1.575m from a $4 attack

On 11 October MEV-bot on the BNB Chain network earned a profit of $1.575 million through an attack using a flash loan of the BH/USDT trading pair on PancakeSwap, according to EigenPhi.

The costs of the arbitrage, the largest in BNB Chain history for such operations, totalled just $4.16.

According to Beosin, the BH token was exploited for about $1.27 million through price manipulation.

$BH token on BNB Chain was exploited for ~$1.27M due to suspected price manipulation. The profits were sent into Tornado Cash.
Attacker: 0xFDbfcEEa1de360364084a6F37C9cdb7AaeA63464

The attacker flashloaned a large amount of $USDT, then called 0x33688938() to add $USDT to the… pic.twitter.com/POppQswi7u

— Beosin Alert (@BeosinAlert) October 11, 2023

The attacker supplied a loan in USDT, then swapped into BH in the BH/USDT pair, draining the token’s liquidity. The contract sets a normal 1 USDT : 100 BH ratio when funds are added. Through the swap, the attacker managed to withdraw roughly 1 USDT for 2 BH.

According to Beosin, the unknown actor sent the proceeds to the mixer Tornado Cash.

On 11 October, BH’s price jumped unexpectedly from $0.01 to around $2 in the BH/USDT pair on PancakeSwap. This move was preceded by a sharp drop in quotes. At the time of writing, the token was trading near $2.1.

Earlier, ForkLog reported in a piece on more than ten major vectors of attacker attacks on DeFi.