DeFi exchange Orion Protocol was hacked and lost $3 million due to third-party vulnerabilities. User assets not affected.
Decentralized exchange platform Orion Protocol suffered a $3 million hack due to problems with re-entry from third-party libraries. The PeckShield service reported this.
Orion allows you to access liquidity pools on centralized and decentralized exchanges directly from your non-custodial wallet. The protocol was hacked due to a re-entry issue.
The hacker repeatedly called the depositAsset function, which exposed the contract to an exploit. First, he transferred 0.4 BNB from Tornado Cash to Orion and another 0.4 ETH via SimpleSwap. In total, the attacker was able to withdraw approximately 1,100 ETH via Tornado Cash and to block approximately 657 ETH at the address of his wallet.
Orion Protocol CEO Alexey Koloskov confirmed the hack and said it was caused by a vulnerability in third-party libraries used to develop Orion. However, he stressed that all funds were stolen from Orion’s own reserves, so all users’ assets are safe.
It’s only the beginning of 2023
But attackers have already managed to steal millions of dollars worth of cryptocurrency in just over a month. The PeckShield service estimates that hackers committed 24 hacks and stole $8.8 million worth of cryptocurrency in January alone, with about a third of all stolen funds going to cryptomixer TornadoCash and instant cryptocurrency exchange services Fixedfloat and SideShift.
