An $18 million flash loan moved a vault's price for one trade
Blockaid said an $18 million flash loan lifted a vault's share price, and the vault paid out at that price.
Flamingo Finance was breached on September 16[1]. The wallet borrowed about $18 million in USDT through Morpho flash loans and staked Curve USDP LP into Strategy in the same move, which lifted VaultYUSDT’s share price[2]. Blockaid said the raised price let the wallet redeem liquid aUSDT at a rate in its favor[3]. The $18 million made the trade bigger[4]. The exploit paid out about $345,900 in profits[5]. Flamingo Finance took that loss[6]. The new price held for one trade[2].
Who gains, who loses
Receipts
KuCoin reported that Flamingo Finance suffered a security breach on September 16 (UTC+8).
“Flamingo Finance suffered a security breach on September 16 (UTC+8), during which the attacker used a Morpho flash loan to borrow approximately $18 million in USDT.”
PANews reported that the attacker borrowed about $18 million USDT through Morpho flash loans.
“The attacker borrowed about $18 million USDT through Morpho flash loans, staked Curve USDP LP into Strategy during the transaction to inflate the VaultYUSDT share price, and then redeemed aUSDT liquidity.”
Cryptonews reported that Blockaid said the attack inflated VaultYUSDT’s share price.
“Blockaid said the attack inflated VaultYUSDT’s share price, allowing the attacker to redeem liquid aUSDT at a favorable rate.”
Cryptonews reported that the attacker used an $18 million USDT flash loan to increase the size of the trade and exploit the pricing flaw.
“The attacker used an $18 million $USDT flash loan to increase the size of the trade and exploit the pricing flaw.”
KuCoin reported that the exploit yielded the attacker approximately $345,900 in profits.
“The exploit yielded the attacker approximately $345,900 in profits.”
Cryptonews reported that FlamingoFinance lost about $345,900 in a DeFi exploit.
“FlamingoFinance lost about $345,900 in a DeFi exploit after an attacker manipulated share prices in older Flamincome contracts, security firm Blockaid said Wednesday.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.