PeckShield, a blockchain security firm said that the Inverse attacker exploited a vulnerability in a Keep3r price oracle that the platform uses to track prices of cryptos. Afterward, the attacker manipulated the price of Inverse’s INV token and took multi-million-dollar loans on Anchor using the inflated INV as collateral.
The attacker then withdrew 901 ETH worth around $3 million at the current price of the cryptocurrency from Tornado Cash. Afterward, he injected the mystery funds using decentralized exchange SushSwap to inflate the price of INV to the Keep3r price oracle.
The attacker ran away with 1,588 ETH, 94 WBTC, 39 YFI, and 3,999,669 DOLA. 73.5 ETH (about $250,000) remains in the attacker’s original Ethereum wallet.
The inverse also said that it will make a proposal to its decentralized autonomous organization (DAO) to “ensure all wallets impacted by the price manipulation are repaid 100%,” though without providing further details.
