WLEO token plunges to near zero after hack enables unlimited minting

On October 11, attackers struck the Wrapped LEO (WLEO) contract and withdrew crypto assets worth $42,000 from the Uniswap pool. The vulnerability they discovered allowed them to mint WLEO tokens that could be exchanged for ETH. Details of the incident are described in the blog of the Leo Finance decentralized protocol.

“As far as I know, this has happened with many other pools on Uniswap. Hackers attack the contract or the address to mint the token. After that, they manage to execute unlimited token issuance and drain the pool on Uniswap”, said the project’s founder Khalil Qazi.

After the hack, users noticed suspicious transactions and quickly pulled liquidity from the pool. This helped limit the extent of the damage.

The attacker, using anonymous addresses, transferred the stolen Ethereum to Binance. This effectively made further tracking nearly impossible.

Kazi could not determine how the attackers managed to carry out the attack. According to him, the vulnerability is probably not related to the WLEO oracle, which allows the contract to receive off-chain data.

“As a result, the number of possible versions narrows to a few. We will provide additional information as the investigation proceeds,” he promised.

Kazi assured that the WLEO incident does not affect the security of LEO and LEO Finance.

“This is a similar situation to if WBTC had been hacked. In that case, the Bitcoin itself is not at risk. Only BTC held in contracts is at risk. In this case, the hackers cannot affect the supply of the first cryptocurrency,” he explained.

The attacker’s action led to a 99.8% drop in WLEO’s price, almost to zero.

In September, the attacker withdrew $15 million from the unfinished DeFi project Eminence by Andre Cronje.

On October 12, the investor group EMN Investigation opened a fundraising drive to finance a lawsuit against Cronje.

Subscribe to ForkLog’s channel on YouTube!