/biz/ - Business & Finance

https://etherscan.io/tx/0xb5c8bd9430b6cc87a0e2fe110ece6bf527fa4f170a4bc8cd032f768fc5219838

I'm not sure how everybody seemed to latch on to the same narrative about how the exploit worked (does nobody do original research?), but here is exactly what happened:

Attacker opened a massive WBTC *long*, using the 5x Short ETH token (https://etherscan.io/token/0xb0200b0677dd825bb32b93d055ebb9dc3521db9d); the attacker used 51.34 WBTC as collateral to borrow 4,698.01 WETH from the iETH contract.

Fulcrum then market-bought as much WBTC as it could using that WETH. Ruh-roh, no order-book exists. Just like last week, after which they bragged about high volume, and took no action.
>https://www.reddit.com/r/ethfinance/comments/f1hhov/bzx_fulcrum_user_lost_250k_instantly_warning/

Attacker's Fulcrum account has now defaulted. He loses *more* than his 51.34 WBTC of equity; he loses all of iETH's WETH. LOL. Fulcrum iETH is now INSOLVENT.

Attacker now sells his borrowed WBTC into the insane-market-price for ETH, repaying dYdX, and having a positive gain - at Fulcrum's expense. Wonder where his profit came from? iETH bag-holders. If you hold iETH, you ARE NOT SAFE - this token is INSOLVENT; borrowed WETH exceeds iETH supply.

Fulcrum is now going to obscure this fact, and say "its ok" that *their largest borrower ever has defaulted*. They are patching the contracts. If you are patching, it means theres a bug in the contracts. This wasn't an Oracle attack (they use Kyber, which IS Uniwswap for WBTC, another misdirection from team's part) - it was them being fleeced.

BREAKING:

bZx got hacked because of their bad oracle system (they use Uniswap). System frozen by admins, ETH lost, users on the hook.

1. attacker shorted WBTC on bzx with 10,000 ETH
2. attacker sold 112 wbtc on uniswap to push down the price
3. profit from short ?
4. attacker paid back 10,000 ETH to dydx from flashloan used in attack

the TX
https://etherscan.io/tx/0xb5c8bd9430b6cc87a0e2fe110ece6bf527fa4f170a4bc8cd032f768fc5219838

Withdraw funds from bZx asap. Buy LINK. Don't ever use bZx again, ever. Even after they integrate LINK.