ChainCatcher message, according to CertiK monitoring, PulsePot.io suffered a flash loan attack. The attacker exploited the swap logic of the swapProfitFees() function (which is a public function that handles the contract's own tokens) to create an arbitrage opportunity and gained $21,500.

ChainCatcher message, according to CertiK Alert on social media: "We discovered a vulnerability in the IPC token deployed 7 days ago. The attacker bypassed the flash loan protection mechanism and exploited the deflationary mechanism of burning tokens in the token pair, stealing approximately $590,000 in funds from the victim's token pair."

ChainCatcher news, according to Cyvers Alerts monitoring, the USDC lending contract of Moonwell on the Optimism network has suffered a flash loan attack. The attacker used a malicious contract address as mToken to obtain unauthorized token approvals from Moonhackers, thereby stealing funds. The attacker received funding support through Tornado Cash on the Ethereum network, and the stolen USDC has been exchanged for DAI, which is currently stored in the attacker's wallet.

ChainCatcher message, according to CertiK Alert monitoring, the Moonhacker contract has suffered a flash loan attack, with current losses of approximately $320,000. The vulnerability is located in the Moonwell lending pool on Optimism. The attacker input the contract address as "mToken" to gain additional token authorization from Moonhackers and deplete it.

ChainCatcher message, on-chain data shows that CryptoPunk 1563 was "traded" via a flash loan for 24,000 ETH (worth nearly 56.3 million USD). The actual operation involved the "buyer" of the NFT borrowing 24,000 ETH from the DeFi protocol Balancer in a single transaction, and then the "seller" repaying the loan to Balancer. No one made money during the buying and selling process, but the executing party did pay network fees, and the NFT did indeed transfer between wallets.Anonymous on-chain detective 0xQuit stated that this flash loan is clearly related to an upcoming meme coin called "Kamala Harris Punk," and this sale appears to be a stunt to generate interest in the token's presale.

ChainCatcher message, Arkham disclosed on social media that a certain MEV bot just borrowed $12 million in a flash loan but only made less than $20 in profit.It is reported that the MEV bot was caught in the middle of a user trying to swap $5,000 worth of SHFL for WETH, with a slippage of about 2%.

ChainCatcher news, according to Lookonchain monitoring, due to a flash loan attack on the Base ecosystem meme coin NORMIE, a trader who spent 1.16 million dollars to purchase 11.23 million NORMIE now finds their value to be less than 150 dollars.It is reported that from March 25 to April 9, the trader spent 1.16 million dollars to buy 11.23 million NORMIE at an average price of 0.1035 dollars and has held them until now without selling.

ChainCatcher news, according to CoinGecko market information, the Base ecosystem Meme coin NORMIE experienced a short-term price drop of 87.6% due to a flash loan attack.Researcher @onchainfudder analyzed that the attacker exploited the remaining 0.63% of the token supply in the contract, repeatedly buying and selling after disabling the tax, triggering the contract to automatically dump tokens exceeding 1% when the tax reached 1%. The entire attack was completed in a single transaction, resulting in a large amount of tokens being sold off. Subsequently, the attacker bought a large quantity at a price of 0 within the same block, gaining huge profits. It is worth noting that the project team also gained considerable revenue from the tax dump, having enough funds to buy back tokens.Currently, the NORMIE team stated that there are over 500 ETH in their deployment wallet, which will be used to address this issue. The team is actively contacting key partners to seek solutions and urges users not to purchase NORMIE tokens until further confirmation is received. The NORMIE team mentioned that they are still deciding whether to restart or fork the project and will provide more updates as soon as possible.

ChainCatcher news, according to the French newspaper Le Monde, the two hackers of the stablecoin trading project Platypus on the Avalanche chain were acquitted by the court. The two hackers, Mohammed M. and Benamar M., stole approximately $8.5 million. French authorities accused Mohammed of counterfeiting and maintaining automated data processing systems, fraud, and money laundering, while Benamar was charged with receiving stolen assets. However, Mohammed claimed to be a "white hat hacker," hoping to "recover funds from the Platypus platform to return later," and sought a "10% bonus of the total amount" paid by the company, after which he was acquitted.Previously, according to monitoring by CertiK, the stablecoin Platypus USD on Avalanche experienced a flash loan attack, resulting in a total asset loss of approximately $9 million.

ChainCatcher news, according to EigenPhi data, a certain MEV Bot made a profit of $1.575 million by spending $4.16 through a flash loan attack.It is reported that the Bot borrowed 7,300 WETH and 2.64 million USDC, and affected the price of BH tokens on PancakeSwap V3 to realize arbitrage.

ChainCatcher news, according to Beosin Alert monitoring, the DeFi protocol Balancer has suffered multiple flash loan attacks, with total losses reaching $870,000. Users are advised to withdraw their LP from the affected pools as per official guidance.ChainCatcher previously reported that Balancer stated on social media that an exploit incident related to previously disclosed vulnerabilities has occurred, but Balancer is unable to pause the affected pools. To reduce risk, users need to withdraw their LP on their own.

ChainCatcher news, according to CertiK monitoring, detected that the SVT token was subjected to a flash loan attack, exploiting a vulnerability in the economic model of the SVT trading contract. The attacker profited approximately $400,000 through repeated buy and sell operations.

ChainCatcher news, according to CoinDesk, blockchain security company Quantstamp has launched a new service "Economic Utilization Analysis" to combat flash loan attacks, which was developed in collaboration with researchers from the University of Toronto. The company stated that this new service can detect commonly used attack paths by attackers through automated tools before the protocol is attacked.

ChainCatcher news, according to monitoring by 0xScope Protocol, the DeFi protocol Earning.Farm has suffered a flash loan attack, resulting in a loss of approximately 283 Ethereum, worth $527,000.

ChainCatcher news, according to monitoring by the crypto intelligence platform Arkham, an MEV bot called a contract yesterday, borrowing 95,000 WETH (worth nearly $180 million) through a flash loan to attack Sashimi Swap. The bot made off with the last remaining funds from Sashimi's investment contract and the slETH contract, totaling only about $3,500.Previously, Sashimi Swap was attacked in December 2021, resulting in a loss of $210,000, after which the project was abandoned. (Source link)

ChainCatcher news, according to PeckShield monitoring, the sharded architecture blockchain network Cellframe Network is suspected to have encountered a flash loan attack. On-chain data shows that the attacker may have profited 245 BNB (approximately $74,000), and the token CELL has dropped over 65%. (Source link)

ChainCatcher news, according to the warning monitoring by PeckShield, the attacker of Cream Finance's flash loan has exchanged 1 million DAI for 555.4 ETH and transferred it to TradeOgre.Previously, in October last year, the DeFi protocol Cream Finance suffered a flash loan attack, resulting in a loss of over 130 million dollars. (source link)

ChainCatcher news, according to CertiK monitoring, the project Platypus on Avalanche experienced a flash loan attack on its stablecoin Platypus USD, resulting in a total asset loss of approximately $9 million. Most of the stolen funds remain in the attacker's contract address, while some funds have been sent to EOA and AAVE pools.The vulnerability seems to lie in the emergencyWithdraw function's validation for the MasterPlatypusV4 contract, which only fails when the borrowed assets exceed the borrowing limit. The function then continues to process the transfer of all users' deposit assets without considering the value of the assets borrowed by the users. The official Platypus Telegram channel stated that USP was subjected to a flash loan attack and is currently working to assess the situation, with all activities paused. (source link)

ChainCatcher message, the Shield community contributors discovered that dForce is suspected of experiencing a flash loan attack exceeding 1.7 million dollars. dForce officials stated that they are investigating and will announce news soon. (Source link)