Clipper DEX liquidity pools exploited for $450,000

by

As a seasoned analyst with a decade of experience in the cryptocurrency space, I’ve seen more than my fair share of hacks and exploits. The recent incident at Clipper is yet another reminder that the DeFi landscape can be treacherous, even for projects that pride themselves on security.

The decentralized trading platform, Clipper, suffered an attack leading to a loss of approximately $450,000. This occurred when the attacker manipulated two of the platform’s liquidity pools on the Optimism and Mainnet blockchains.

4 am UTC on December 1st, an intruder took advantage of Clipper’s capability to handle combined swap and withdrawal operations within its withdrawal function, as detailed in their initial post-incident report.

Approximately 6% of the total assets secured within the platform were missing from liquidity pools on Optimism and Base. This significant shortage led the platform to halt swap transactions and deposit acceptance across all networks, as well as temporarily disabling the option for users to withdraw their funds in a single token form.

Clipper Dex explained that since it’s a non-custodial platform, you can always make withdrawals. Yet, these withdrawals must include a combination of all assets within the pool.

According to initial findings by Chaofan Shou, one of the co-founders at Fuzzland Security, it appears that the exploit originated from a breach of a private key, allowing the attacker to create legitimate deposit and withdrawal requests to steal funds. However, Clipper has refuted these assertions, emphasizing that their security system is engineered specifically to avoid such weaknesses.

In the meantime, Clipper is confidently informing its user base that their funds are safe, with frequent updates being provided as they delve deeper into the investigation. Simultaneously, the team is diligently tracking the stolen resources and has extended an invitation for open communication to the perpetrator.

Approximately a month and a half has passed since Radiant Capital, using LayerZero technology, suffered a loss of more than $50 million on October 18th. This was due to hackers infiltrating the systems of three key developers within the protocol, which enabled them to exploit the lending system after acquiring control over its private keys and smart contracts.

In more recent times, the Thala protocol experienced a loss of approximately $25.5 million following an update to its farming contract agreements that exposed a weakness.

Based on reports from blockchain security specialist PeckShield, it’s estimated that about $88.4 million was stolen in cryptocurrency hacks during the month of October. This brings the cumulative on-chain losses up to a staggering $181 million.

According to a recent report by Immunefi, cyber-attacks in November primarily focused on Decentralized Finance (DeFi) rather than centralized finance systems. Furthermore, the total crypto losses from January to November in 2024 showed a decrease of 15% compared to the corresponding period in the previous year.

Read More

2024-12-02 12:20