Penpie DeFi Hack: $27M Stolen Funds

In partnership with

TL;DR

Penpie, a DeFi protocol on Pendle, was hacked on September 3, 2024, resulting in $27 million in cryptocurrency theft. The breach, first reported by Chaofan Shou of Fuzzland, exploited a security vulnerability. Penpie and Pendle paused operations and are negotiating with the hacker for the return of funds.

Make Sure This Hack Doesn’t Happen To You 🫵

Subscribe to Blockbasis and get access to our premium scanner to check whether your the funds in your wallet is safeguarded from hacks 🔐

For a limited period only, you can get a 7 day FREE trial!

All for just $50/month after the trial.
Don't miss out! Grab your FREE trial today 👇

On September 3, 2024, Penpie, a decentralized finance (DeFi) protocol built atop Pendle, experienced a severe security breach, resulting in the theft of $27 million in various cryptocurrencies.

This incident underscores the vulnerabilities that can affect even well-established DeFi platforms.

This detailed analysis explores the nature of the exploit, the immediate response from Penpie and Pendle, and the ongoing efforts to address the fallout.

The Nature of the Exploit

The hack against Penpie was a calculated attack that exploited a specific security vulnerability within the protocol.

The hack was initially uncovered by Chaofan Shou, an X account associated with Fuzzland.

According to initial reports, the hacker siphoned off approximately $17 million before Penpie's team became aware of the breach. The delay in recognizing the intrusion contributed to an additional $10 million in losses.

According to EmberCN, the stolen assets included Ether (ETH) and various stablecoins, such as wrapped USDC and sUSDE.

After the initial breach, the hacker converted a significant portion of the stolen assets into ETH, totaling 11,109 ETH, equivalent to about $26.95 million.

Blockchain analysis reveals that the hacker laundered 1,000 ETH, approximately $2.42 million, through the crypto mixer Tornado Cash, according to DeBank data

This mixer obfuscates the origin of the funds, making them harder to trace. Notably, the hacker's address received an initial funding of 10 ETH from Tornado Cash just hours before the attack commenced.

Initial Response from Penpie

Penpie’s response to the breach was swift but came with delays. Approximately an hour after the hack began, Penpie confirmed the security breach via an X post.

The protocol promptly paused all deposits and withdrawals to mitigate further losses.

Despite these actions, the delay in response allowed the hacker to extract a substantial amount of funds before any preventive measures could be implemented.

The immediate suspension of transactions was a critical step in halting further losses.

Pendle's Precautionary Measures

Pendle, the platform upon which Penpie is built, acted decisively to protect its own ecosystem.

Upon learning of the breach, Pendle paused all contracts as a precautionary measure, safeguarding approximately $105 million that could have been at risk.

Pendle confirmed that the breach was isolated to Penpie and did not impact the Pendle protocol itself.

In response to the incident, Pendle engaged security experts from Seal 911 to assess the situation and develop strategies to prevent future breaches.

This proactive approach helped to mitigate the potential impact on Pendle's broader ecosystem and ensured that Pendle's funds remained secure.

Penpie’s Negotiation with the Hacker

In a bid to recover the stolen funds, Penpie reached out to the hacker with an offer to negotiate.

The protocol proposed a bounty for the safe return of the stolen assets and assured that no legal action would be pursued if the funds were returned.

Penpie also extended an offer for the hacker to transition into a white-hat role, where their skills could be recognized and rewarded.

Penpie's appeal highlights the desperate measures that organizations sometimes take in the wake of a significant security breach.

By offering a cooperative resolution, Penpie aimed to recover the stolen assets and minimize the impact on its community.

Ongoing Developments and Future Prospects

As of the latest updates, Penpie faces significant challenges in recovering the stolen funds due to the use of Tornado Cash.

The crypto mixer’s role in laundering the assets complicates recovery efforts and underscores the difficulties in tracing and retrieving stolen cryptocurrencies.

Penpie has been working to reposition its platform’s front-end and is focused on ensuring that users can securely withdraw their remaining funds.

The ongoing recovery efforts reflect the protocol's commitment to restoring stability and safeguarding its community’s assets.

The $27 million hack of the Penpie DeFi protocol is a stark reminder of the vulnerabilities that can afflict even the most sophisticated DeFi platforms.

While Penpie’s and Pendle’s responses were critical in containing the situation and protecting additional assets, the breach highlights the need for continuous vigilance and robust security measures within the DeFi space.

As Penpie works towards recovery and resolution, the incident serves as a cautionary tale for the broader DeFi community, emphasizing the importance of security and rapid response in mitigating the impact of such attacks.

Want SOC 2 compliance without the Security Theater?

Question 🤔 does your SOC 2 program feel like Security Theater? Just checking pointless boxes, not actually building security?

In an industry filled with security theater vendors, Oneleet is the only security-first compliance platform that provides an “all in one” solution for SOC 2.

We’ll build you a real-world Security Program, perform the Penetration Test, integrate with a 3rd Party Auditor, and provide the Compliance Software … all within one platform.

Schedule a demo for pricing

🦾 Master AI & ChatGPT for FREE in just 3 hours 🤯

1 Million+ people have attended, and are RAVING about this AI Workshop.
Don’t believe us? Attend it for free and see it for yourself.

Save your spot here. (100 free spots only)

Highly Recommended: 🚀

Join this 3-hour Power-Packed Masterclass worth $399 for absolutely free and learn 20+ AI tools to become 10x better & faster at what you do

👉Save your seat  now (FREE for First 100)

🗓️ Tomorrow | ⏱️ 10 AM EST

In this Masterclass, you’ll learn how to:

🚀 Do quick excel analysis & make AI-powered PPTs 
🚀 Build your own personal AI assistant to save 10+ hours
🚀 Become an expert at prompting & learn 20+ AI tools
🚀 Research faster & make your life a lot simpler & more…

👉 Register here (Offer valid for First 100 people only)🎁