Hexagate and Chainalysis said an attacker used about $44 million in flash loans to manipulate a DEX price, fake a roughly $140 million deposit and capture a full day of interest in one second.
LpdFi lost about $700,000 in an exploit that manipulated its interest accounting through a flash-loan attack. Hexagate detected the incident, and Chainalysis described how the attacker borrowed roughly $44 million in flash loans, pushed the LPD token price 71 times higher on a DEX, and then used tokens worth only about $2 million to fabricate a deposit of roughly $140 million inside the protocol. One second later, just after crossing the protocol's daily interest settlement boundary, the attacker claimed a full day's interest on the inflated position, causing the protocol to liquidate its entire liquidity pool and pay out the stolen funds. After repaying all loans, the attacker made about $700,000 in profit and quickly moved the proceeds through Relay and Tornado Cash, a crypto mixing service used to obscure fund flows.