DeFi
DeFi protocols Sonne Finance and ALEX Lab lose over $24 million in separate hacks
At least two DeFi projects were targeted with significant exploits in the early hours of the day, resulting in millions of dollars in losses.
Sonne Finance exploited
Decentralized liquidity provider Sonne Finance was the victim of a $20 million exploit on its Optimism network. USDC and Wrapped Ethereum (WETH) contracts, according to to blockchain security company Cyvers.
In a May 15 statement, the DeFi protocol confirmed the incident and attributed the exploit to a donation attack on its Compound v2 forks. He declared:
“We have avoided the problem in the past, by adding the markets with 0% collateral factors, adding collaterals and burning them, then increasing the c factors as proposed.”
However, an attempt to integrate VELO into the Optimism The market allowed the attacker to exploit the protocol unnoticed, resulting in a loss.
Meanwhile, security experts prevented an additional theft of $6.5 million by injecting $100 worth of VELO as collateral into the soVELO pool.
Sonne Finance said it was prepared to offer a bounty to the attacker as efforts to recover the funds continue.
Following the theft, the price of SONNE, a digital asset connected to the project, fell by more than 60% to $0.02617 at press time.
Bitcoin DeFi project loses over $4 million
ALEX Lab, a Bitcoin The DeFi app lost over $4 million in various tokens due to a hacking incident earlier today.
Blockchain security company Certified reported that the attackers likely had access to the private key controlling ALEX’s XLink bridge. This service allows users to transfer tokens between different blockchains.
The hacker managed to move around $300,000 worth of BTC, $3.3 million worth of stablecoins, and $75,000 worth of Sugar Kingdom tokens.
ALEX Lab developers confirmed the hack and claimed to have identified the attacker. The team also declared:
“A significant amount of the funds associated with the hacker have been frozen by major exchanges, preventing further misuse.”
Nonetheless, the project offered a 10% bounty to the hacker, adding that:
“ALEX assures that once compliance is met, there will be no further pursuit or involvement of law enforcement. This offer is valid until May 18 at 0800 UTC. The responsible person must contact [email protected].”