Yet another Defi platform got hacked again

[AhmadM]

So lately there's one of DeFi platforms (Akropolis) that has admitted they got hacked (over 2 million in DAI) through a flash loan attack recently.

“At ~14:36 GMT we noticed a discrepancy in the APYs of our stablecoin pools and identified that ~2.0mn DAI had been drained out of the yCurve and sUSD pools,” the project reported in a statement released the evening of November 12.

[...]

The attacks seemingly come as a surprise for Akropolis, which said the pools had undergone two independent audits. “However, the attack vectors used in the exploit were not identified in either audit,” it said “The essence of the exploit in question is a combination of a re-entrancy attack with dYdX flash loan origination.”

Read the full article -> https://decrypt.co/48081/defi-platform-akropolis-admits-to-being-hacked-for-2-million

Previously there are several DeFi got the flash loan attack as well such as Harvest finance and bZx.
What's your thought about it? Does DeFi are too vulnerable to be attacked?

[batang_bitcoin]

They are vulnerable to attacks too. Just like DEX and centralized exchanges, they are not exempted from the attacks and abused of hackers. $2m of DAI is a big amount of loss. The reason why everybody has to think before investing to a Defi is because you're allowing your money to stay on them and if an attack like this occurred, it's likely that your fund will also be part of it which is we don't want to happen. That's one major reason why it's better for me to buy and hold.

[drlukacs]

Defi is not really vulnerable to attack, it is only due to the subjectivity of Defi projects about security, then they are only interested in the amount they have raised but are sketchy in the security mechanism. they took too much importance in developing the protocol, and that in turn made it easier for hackers to attack.
This is also one of the problems that makes Defi not a long term trend. As it may be sold off at any time, people should not hold or staking at this time.

[InwardContour]

Does DeFi are too vulnerable to be attacked?

It's surprising to see this news that Akropolis which got audited was also attacked. I think these hackers are targeting DEFI platforms with lending feature especially. I remember buying 2k$ worth of BZRX before their platform official launch, but price went south after their platform hack. I think the audit companies do need to upgrade, in order to spot loopholes which can be taken advantage by hackers.

[pungopete468]

As per incident you have stated I really think they are immune and vulnerable to attacks I really think it's really risky to invest to DeFi right now not just because there's a lot of scam DeFi's that is all over around but if they are successful they were then immune to attacks.

[optimisticcm]

So lately there's one of DeFi platforms (Akropolis) that has admitted they got hacked (over 2 million in DAI) through a flash loan attack recently.

“At ~14:36 GMT we noticed a discrepancy in the APYs of our stablecoin pools and identified that ~2.0mn DAI had been drained out of the yCurve and sUSD pools,” the project reported in a statement released the evening of November 12.

[...]

The attacks seemingly come as a surprise for Akropolis, which said the pools had undergone two independent audits. “However, the attack vectors used in the exploit were not identified in either audit,” it said “The essence of the exploit in question is a combination of a re-entrancy attack with dYdX flash loan origination.”

Read the full article -> https://decrypt.co/48081/defi-platform-akropolis-admits-to-being-hacked-for-2-million

Previously there are several DeFi got the flash loan attack as well such as Harvest finance and bZx.
What's your thought about it? Does DeFi are too vulnerable to be attacked?

These platforms will improve their way up to be secure with time because as with every new thing it has many requirements to perform ideally which can take a lot of time and effort that is why i say that give defi some time and we will see huge improvement. I expect defi platforms to be very secure and professional in 2 to 3 years time.

[AhmadM]

Defi is not really vulnerable to attack, it is only due to the subjectivity of Defi projects about security, then they are only interested in the amount they have raised but are sketchy in the security mechanism. ~snip~

In other words, most defi projects are not prioritizing security on their system/mechanism? What I mean is most of them just put the security on average which as long it could be called as "safe" then it's enough..

These platforms will improve their way up to be secure with time because as with every new thing it has many requirements to perform ideally which can take a lot of time and effort that is why i say that give defi some time and we will see huge improvement. I expect defi platforms to be very secure and professional in 2 to 3 years time.

Of course they should do that, if they don't improve it then people would retake the remaining funds on them and leave it. In the worst scenario, there's a chance they would be the next dead project.

[Yaunfitda]

Previously there are several DeFi got the flash loan attack as well such as Harvest finance and bZx.
What's your thought about it? Does DeFi are too vulnerable to be attacked?

At first I'm a advocate of third party doing an audit of the code, before finally releasing it to production. But it seems that it is not enough as hackers are one step ahead of the game, finding loopholes in front wherein this so called auditors can't find in the first place. I'm sorry to hear that another of this Defi platform got hacked, but I guess this will be the scenario and more are going to come in the future in projects are not going to be active testing their systems even after it has been released.

[AmoreJaz]

Defi is not really vulnerable to attack, it is only due to the subjectivity of Defi projects about security, then they are only interested in the amount they have raised but are sketchy in the security mechanism. ~snip~

In other words, most defi projects are not prioritizing security on their system/mechanism? What I mean is most of them just put the security on average which as long it could be called as "safe" then it's enough..

These platforms will improve their way up to be secure with time because as with every new thing it has many requirements to perform ideally which can take a lot of time and effort that is why i say that give defi some time and we will see huge improvement. I expect defi platforms to be very secure and professional in 2 to 3 years time.

Of course they should do that, if they don't improve it then people would retake the remaining funds on them and leave it. In the worst scenario, there's a chance they would be the next dead project.

a lot of these defi projects are vulnerable to attacks because let's admit it, most of them are launched prematurely. i don't think they really look into their security diligently. as most of them are racing to get their customers and launch as soon as possible to catch the hype, they haven't dedicated enough time to secure their network.
defi investors should really assess their investments on this platform, and evaluate its long-term roi. because am seeing most of them will die very soon as they have empty foundation to begin with.

[2double0]

When we heard news regarding bzx hack, their community dumped it quite hard the moment the news was released. But I am quite surprised to see that akropolis is stable yet after this news, looking like a trap and traders should stay away from their 'beehive'. It is not acknowledgeable when they call it Decentralized Finance but trust auditors who work as central authorities to do their job.

[Johnyz]

Hackers will make everything vulnerable because they are working hard for this and we don’t have the guarantee of being safe in cryptomarket, its all about the risk. DeFi is same with cryptocurrency of course, so hacking incidents are not new anymore and of course there’s also a possibilities that this can be an inside job, either to scam people or a greedy member of the team, who knows.

[lionheart78]

I think they are vulnerable to attack because they rush their launching to compete against other cryptocurrency projects.  A platform should be planned for years and should be tested heavily for possible exploits.  The thing with these platforms (not only Defi platform) is that they are in a rush to earn big sacrificing security testings.  

[GrosWesh]

I am not sure, once again, that we can really call what happened an 'attack'.  

 By offering the tools it brings to its users a defi platform must know some people will be clever and will manage to abuse the system. I think it's more ingenuity than hacking.

My 2 cents

https://twitter.com/bneiluj/status/1327179229679726592

[Stedsm]

DeFi are mostly just shit with this name alone being the only reason why the tokens got surged higher, else there's no f**king security that these tokens have. Isn't it too early for us to see these types of news coming so quick for so many DeFi tokens? If these DeFi platforms are not safe themselves, how the hell can someone trust them with their funds? There are a few billion USD that are invested in many DeFi platforms, if these platforms can't take care of their own, how can they assure others to put their money in these clowns' hands.

[GreatArkansas]

I really hope these kind of attacks are not an insider or the platform itself are involve and they just want to take advantage with their users.
These kind of attacks are also one of the disadvantages of some decentralized exchange since the platform assuming that they don't have access to your funds since you got the keys of your wallets or you are the one controlling it, but then again this kind of attack may really happen anytime.

[eaLiTy]

Previously there are several DeFi got the flash loan attack as well such as Harvest finance and bZx.
What's your thought about it? Does DeFi are too vulnerable to be attacked?

The answer is explained in your topic itself, yet another DeFi platform is hacked and that means it is vulnerable to attacks and then if you make a search you will see dozens of scams in the market as well. It looks like a treasure trove for scammers just like they did in the past during the ICO days before the last rally and the same is happening again which is really unfortunate.

[TravelMug]

Lol, there is an auditor and yet they haven't found the exploits that the hackers discovered? How come?

So this so called third party auditors are just useless for them, we don't know how much money they are getting paid by these projects to do this so called "check my code for exploits" thingy. I also have a hunch that maybe these auditors see the bug, didn't tell the project so that they themselves will take advantage of it before everyone could find out.

And that $2 million was quickly liquidated, so it means this have been plan in advance to cover their tracks that's why I suspected that this could be an inside job after-all. And yeah, don't blindly trust any projects with the DeFi hype because chances are you are going to lose your hard earn money.

[Coin_trader]

As per incident you have stated I really think they are immune and vulnerable to attacks I really think it's really risky to invest to DeFi right now not just because there's a lot of scam DeFi's that is all over around but if they are successful they were then immune to attacks.

Please check the right use of the word immune because its contradicting ythe thought of your statement. All project is vulnerable to attacks whether Decentralized or Centralized. The problem on Decentralized is when the code has some major bug that do not fixed once the product was already running. Since it was powered by smart contract, It's hard to stop it once it's started and most of the DeFi project are rushing just to present there product. Not all DeFi are not safe for investment like Chainlink. There are just some project like loan and financing that are prone to attack.

[maxreish]

Akropolis released an open letter to the hackers;
- https://medium.com/@akropolisio/open-letter-to-akropolis-delphi-hacker-91e883667cc

We would like to propose that you return the funds of our community members within 48 hours and in return we will offer a $200,000 USD bug bounty. We will take measures to protect your identity as required.
If you decide not to cooperate we will pursue criminal action and contact law enforcement.

They've admitted the hacks, the security is not really safe on this defi platform systems. Good thing they have a plan to compensate their user's funds but this doesn't get rid the fact that they are prone to hacks and their reputation changed suddenly because of this incident. Defi projects like this loan/trading platforms are still new however giving most of the users now the doubt because they had the weak security that a decentralized finance should have strong guaranteed about it's security because they are handling finances.

[Hallmader]

It has been warned over and over again that Defi is not yet in its best form right now and so it is more vulnerable to attacks as of this infancy stage than it will be in the future after years of development. There are still some loopholes that needed some fixing ang polishing. This is the reason why experts are advising Defi investors to do it slow and small with it. The risk is high. And there is sufficient data to support that, not just this latest attack.