Penpie Hacker Launders 26% of $27M Stolen Funds in 12 Hours

2 min read | September 04, 2024 09:17 AM EDT | By Team Kalkine Media

A hacker who stole $27 million from the Penpie protocol on September 3 has laundered approximately $7 million of the stolen funds through the crypto mixer Tornado Cash within just 12 hours. The breach highlights significant security risks in decentralized finance (DeFi) systems.

Web3 security firm Cyvers reported on September 4 that 26% of the stolen funds were funneled through Tornado Cash addresses. Blockchain security firm PeckShield confirmed that the hacker continues to move the stolen funds through multiple transactions.

Following the attack, the {Penpie} (PNP) protocol suspended all deposits and withdrawals. The attack began at 17:45 UTC when the hacker deployed the initial contract used in the breach. Decentralized finance protocol Pendle responded by halting all contracts, effectively preventing further theft and safeguarding $105 million that could have been at risk. Pendle's contracts were safely reactivated at 00:50 UTC on September 4 after thorough checks.

The rise in cyberattacks targeting cryptocurrencies and DeFi platforms is a growing concern. An Immunfi report released on August 29 revealed that over $1.2 billion has been stolen in hacks and exploits in 2024, marking a 15.5% increase from the previous year.

The FBI also issued a warning on September 3 about North Korean cybercriminals targeting DeFi and cryptocurrency firms through sophisticated social engineering tactics. The month of August alone saw significant losses, with security firm PeckShield reporting over $313 million in stolen funds, including $238 million in Bitcoin and $55 million in Dai.

In a separate incident, India's WazirX exchange suffered a major cyberattack in July, resulting in a loss of $234.9 million. The exchange has begun a phased plan to restore operations and is pursuing legal action in Singapore. As of September 3, WazirX has allowed users to withdraw up to 66% of their Indian rupee balances.

These incidents underscore the pressing need for enhanced security measures in the rapidly evolving DeFi space.


Disclaimer

The content, including but not limited to any articles, news, quotes, information, data, text, reports, ratings, opinions, images, photos, graphics, graphs, charts, animations and video (Content) is a service of Kalkine Media Incorporated (Kalkine Media), Business Number: 720744275BC0001 and is available for personal and non-commercial use only. The advice given by Kalkine Media through its Content is general information only and it does not take into account the user’s personal investment objectives, financial situation and specific needs. Users should make their own enquiries about any investment and Kalkine Media strongly suggests the users to seek advice from a financial adviser, stockbroker or other professional (including taxation and legal advice), as necessary. Kalkine Media is not registered as an investment adviser in Canada under either the provincial or territorial Securities Acts. Some of the Content on this website may be sponsored/non-sponsored, as applicable, however, on the date of publication of any such Content, none of the employees and/or associates of Kalkine Media hold positions in any of the stocks covered by Kalkine Media through its Content. Kalkine Media hereby disclaims any and all the liabilities to any user for any direct, indirect, implied, punitive, special, incidental or other consequential damages arising from any use of the Content on this website, which is provided without warranties. The views expressed in the Content by the guests, if any, are their own and do not necessarily represent the views or opinions of Kalkine Media. Some of the images/music that may be used in the Content are copyright to their respective owner(s). Kalkine Media does not claim ownership of any of the pictures displayed/music used in the Content unless stated otherwise. The images/music that may be used in the Content are taken from various sources on the internet, including paid subscriptions or are believed to be in public domain. We have used reasonable efforts to accredit the source wherever it was indicated or was found to be necessary.


We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.