PeckShield experts discovered the suspicious transactions on the morning of Monday, August 14. Funds were withdrawn from the Zunami protocol in two transactions. Immediately after the withdrawal, the tokens went to the Tornado Cash mixing service.
“It looks like the zStables pool has come under attack. Please do not buy zETH and UZD tokens at this time. The contract to release them has been attacked,” Zunami developers wrote after PeckShield reported the attack.
According to PeckShield analysts, as part of the attack on Zunami, hackers took advantage of a smart contract bug that calculates the price of assets. It was essentially an attack by manipulating the price of an asset.
The founder of SlowMist, which also works in blockchain security, spoke about the discovery of this vulnerability two months ago. According to Xian Yu, the Zunami team was informed of the vulnerability in a timely manner, but the smart contract code was never patched.
<blockquote.
“Unfortunately, this communication experience turned out to be unpleasant. If you think about it, the situation could have been prevented,” Yu noted.
It was recently reported that there has been a significant increase in the proportion of transactions involving criminally derived assets on the Etherium network.