It is rare for thieves to leave with their loot, but a hacker did just that after stealing over $1 million from the DeFi protocol Zeed.
The hacker stole almost $1 million by exploiting a vulnerability in the DeFi project and then locking it in a self-destructing contract, making it impossible for anyone to recover the stolen assets.
BlockSec, a blockchain security firm, identified the attack on the Zeed protocol and reported it about 8 p.m. UTC on April 21.
The hacker took advantage of the DeFi lending protocol’s incentive distribution mechanism, which bills itself as a “decentralised financial integrated ecosystem.”
The vulnerability allowed the hacker to create and sell more tokens, causing the token’s value to fall to zero and netting the hacker roughly $1 million.
The hacker then delivered the stolen cryptocurrency to an “attack contract”—a smart contract capable of swiftly and automatically executing the discovered vulnerability.
The attack contract was designed to self-destruct before the hacker transferred the stolen funds for reasons known only to the hacker. The cash cannot be recovered since the contract is irrevocable.
The attack contract comprised $1,041,237.57 in BSC-USD, according to a blockchain scanner. On April 21, at 7:15 a.m. UTC, it was successfully destroyed.
As of press time, the Zeed protocol has not commented or provided an update on the breach.
As hackers improve their tactics, the ubiquity of vulnerabilities and attacks in crypto continues to be a cause of worry. Over $1 billion in cash was taken in the first quarter of this year alone, including more than $600 million from the Axie Infinity hack.
