Attacker scoops $370,000 profit in $51 million flash loan arbitrage on Avalanche
Quick Take
- The attacker borrowed $51 million in a flash loan to launch the attack.
- After paying back the loan, the attacker was left with a profit of $370,000.
Nereus Finance, a DeFi staking platform on Avalanche, was impacted in a flash loan arbitrage attack on Tuesday, that saw the exploiter drain $370,000 in USDC stablecoin, according to a report by CertiK.
On-chain data from Snowtrace shows the attacker launched the exploit with a $51 million flash loan. The funds were used to execute a flash loan attack that manipulated token pricing on Nereus. The attacker paid back the $51 million loan but still had $370,000 in USDC after the arbitrage trade was over.
The attacker then 'bridged’ the funds from the Avalanche blockchain to the Ethereum network. Bridging in crypto means the transfer of tokens across different blockchains. The bridged funds were then swapped into 194 ETH ($310,000) and 15,800 DAI ($15,800) and kept in this address which also matches the attacker’s address on Avalanche.
Only about 14 ETH and 15,800 DAI are left in this address as of the time of publishing. The attacker transferred 180 ETH to four different addresses (45 ETH each). These funds have all been moved to Free Float, a crypto exchange on the Lightning Network, which likely signals the arbitrageur’s attempt to cash out the profit.
Nereus Finance did not immediately respond to The Block’s request for comments.
Flash loan exploits continue to be a major pain point for DeFi protocols. The US Federal Bureau of Investigation stated in August that flash loan and price manipulation exploits are among some of the risk factors for DeFi users.
© 2023 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
