Ola Finance, a lending platform, was hacked today on Fuse Network, one of the several blockchains it uses, and the attacker made off with an estimated $3.6 million in various assets. The incident involved a smart contract vulnerability known as a reentrancy problem, which allows hackers to make many calls to a protocol in order to steal assets. Just a few weeks ago, two Gnosis Chain DeFi protocols — Hundred Finance and Agave – lost customer assets totaling more than $11 million due to reentrancy flaws, resulting in flash loan assaults.
The Ola Finance hacker began by borrowing funds using their own collateral, according to security firm PeckShield. The hacker was then able to withdraw the collateral without repaying the loan they took out by exploiting a reentrancy vulnerability in Ola’s smart contracts. The culprit subsequently carried out the same scheme on other Ola Finance pools, netting a total of $3.6 million.
After draining the funds, the offender used Fuse’s own cross-chain bridge to transfer them to other blockchains, including BNB Chain and Ethereum. The hacker is said to have $3 million on Ethereum and $637,000 on BNB Chain, out of the total loot. Ola Finance said it is still looking into the situation and will provide a post-mortem report soon. To limit the harm, Ola’s decentralised lending product on Fuse Network has been suspended. The project stated that the issue had no impact on its loan services on other blockchains.
Read more: Axie Infinity gives relief to players by reimbursing them following massive hack
