/biz/ - Business & Finance

https://etherscan.io/tx/0xb5c8bd9430b6cc87a0e2fe110ece6bf527fa4f170a4bc8cd032f768fc5219838

I'm not sure how everybody seemed to latch on to the same narrative about how the exploit worked (does nobody do original research?), but here is exactly what happened:

Attacker opened a massive WBTC *long*, using the 5x Short ETH token (https://etherscan.io/token/0xb0200b0677dd825bb32b93d055ebb9dc3521db9d); the attacker used 51.34 WBTC as collateral to borrow 4,698.01 WETH from the iETH contract.

Fulcrum then market-bought as much WBTC as it could using that WETH. Ruh-roh, no order-book exists. Just like last week, after which they bragged about high volume, and took no action.
>https://www.reddit.com/r/ethfinance/comments/f1hhov/bzx_fulcrum_user_lost_250k_instantly_warning/

Attacker's Fulcrum account has now defaulted. He loses *more* than his 51.34 WBTC of equity; he loses all of iETH's WETH. LOL. Fulcrum iETH is now INSOLVENT.

Attacker now sells his borrowed WBTC into the insane-market-price for ETH, repaying dYdX, and having a positive gain - at Fulcrum's expense. Wonder where his profit came from? iETH bag-holders. If you hold iETH, you ARE NOT SAFE - this token is INSOLVENT; borrowed WETH exceeds iETH supply.

Fulcrum is now going to obscure this fact, and say "its ok" that *their largest borrower ever has defaulted*. They are patching the contracts. If you are patching, it means theres a bug in the contracts. This wasn't an Oracle attack (they use Kyber, which IS Uniwswap for WBTC, another misdirection from team's part) - it was them being fleeced.