Permissionless lending and margin trading protocol OpenLeverage has reportedly fallen victim to multiple hacks draining $230K worth assets.
The hacks were flagged by blockchain security Cyvers Alerts on X (Twitter). Per the post, the losses incurred is around $230,000 worth crypto and the attacker’s wallet was funded by Tornado Cash.
“Our system has detected the malicious contract deployment 13 sec earlier than attack transactions,” the post read. “Stolen funds are still at attacker’s address.”
🚨ALERT🚨Our system has detected a multiple transactions with @OpenLeverage
Total loss is around $230K. Attacker has funded by @TornadoCash!
Our system has detected the malicious contract deployment 13 sec earlier than attack transactions!
Stolen funds are still at attacker\'s… pic. .com/xK6aN2tLbd— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) April 1, 2024
Tornado Cash is an OFAC-sanctioned crypto mixing protocol which is claimed to have been used by North Korea’s Lazarus Group to launder more than $100m stolen in crypto heists.
Shortly after the hack, OpenLeverage confirmed that it has paused its operations and investigations are underway.
“Accumulated insurance and buyback funds should be able to cover the loss,” it said.
OpenLeverage protocol is paused; the investigation is underway. Accumulated insurance and buyback funds should be able to cover the loss.
D1 is NOT affected.
More details to be shared soon. https://t.co/4DaS6Y5gQC
— OpenLeverage (@OpenLeverage) April 1, 2024
Further, the update from the company confirmed “a loss of 220K on BNB Chain & 40K on Arbitrum.”
“Thankfully, our in-protocol insurance, OLE buyback fund, and protocol reserves will cover all protocol losses. So, NO user funds will be lost.”
Following the hacks, OpenLeverage has decided to close its trading and lending protocol, initiating processes for users to withdraw funds.
“All protocol actions remain paused until withdrawal processes start about early next week,” a recent post read.
Additionally, the protocol has also announced a bounty to the hacker on return of stolen funds. However, the exact reward hasn’t been specified.
“The hacker will receive a bounty to return funds, and the trace and legal process will start immediately.”
The hacker will receive a bounty to return funds, and the trace and legal process will start immediately.
— OpenLeverage (@OpenLeverage) April 1, 2024
OpenLeverage secured investment from Binance Labs in June 2022, though the precise amount of funding were undisclosed.