Hexagate said the attacker used about $44 million in flash loans to manipulate a DEX price, fabricate a roughly $140 million deposit and capture a full day of interest in one second.
LpdFi was exploited for about $700,000 after an attacker used roughly $44 million in flash loans (unsecured crypto loans repaid within one transaction) to manipulate the price of LPD on a DEX (decentralized exchange) by 71 times. Hexagate detected the attack and said the inflated price let the attacker use tokens worth only about $2 million to fake a deposit of roughly $140 million in the protocol. One second later, just after crossing the protocol's daily interest settlement boundary, the attacker collected a full day's interest on the exaggerated position, forcing the protocol to liquidate its entire liquidity pool and pay out the stolen funds. After repaying all loans, the attacker made about $700,000 and quickly moved the proceeds through Relay and Tornado Cash, a crypto mixing service used to obscure fund flows.