Ethereum Watch

Furucombo, a dApp focused on easily creating multi-step transactions for trading and DeFi without knowing how to code, just got compromised. At press time, a hacker managed to drain over $14 million of users’ funds.

Furucombo, a dApp focused on easily creating multi-step transactions for trading and DeFi without knowing how to code, just got compromised. At the moment of writing, a hacker managed to drain over $14 million of users’ funds.

The hacker compromised Furucombo’s proxy smart contract, which enabled them to withdraw ETH and ERC20 tokens. 

The hacker then started sending funds to the mixer Tornado Cash to cover their tracks and withdraw funds.

Currently, the hacker’s address holds over 4,560 ETH, worth roughly $6.8 million, and more than $7 million in ERC20 tokens, including more than 5.5 million DAI. These holdings do not include funds that were sent to Tornado Cash for laundering.

Anyone who interacted with Furucombo proxy should revoke their approvals to withdraw funds from their wallet using Revoke. The addresses of Furucombo contracts to check:

• 0x57805e5a227937BAc2B0FdaCaA30413ddac6B8E1
• 0x17e8ca1b4798b97602895f63206afcd1fc90ca5f

Over the last year, there were numerous hacks and exploits of DeFi protocols. The space is nascent, but the Total Value Locked in DeFi smart-contracts continues to grow, exceeding $37 billion at the time of press. Furucombo’s hack is another reminder for DeFi users to seriously consider contract security and not use money in new protocols that they can’t afford to lose.