A security flaw in Abracadabra’s smart contracts has led to a major exploit, with a hacker draining around 6,262 ETH—valued at roughly $13 million—from the protocol’s liquidity pools.
The attack, identified as a flash loan exploit, was initially flagged by blockchain security firm PeckShield.
Abracadabra’s lending system, known as “cauldrons,” integrates with GMX liquidity pools to facilitate borrowing and lending. The hacker reportedly manipulated the liquidation process in the GMX V2 integration, exploiting a weakness that allowed them to extract funds from the protocol.
Blockchain researcher Weilin Li analyzed the incident, noting that the attacker used a flash loan to trigger self-liquidation. Flash loans, a DeFi feature allowing users to borrow funds without collateral as long as they are repaid within the same transaction block, played a key role in the exploit.
The attacker borrowed Abracadabra’s stablecoin, Magic Internet Money (MIM), and executed a multi-step strategy to convert the debt into cash, profiting from liquidation incentives.
Despite the breach, a GMX developer confirmed that the attack did not compromise GMX’s core contracts. The stolen funds were later transferred from Arbitrum to Ethereum.
This isn’t the first security incident for Abracadabra. In January 2024, another exploit targeting its MIM stablecoin led to a $6.5 million loss, raising concerns over the protocol’s ongoing vulnerabilities.
Alex Mashinsky, the former CEO of collapsed crypto lender Celsius, has formally withdrawn any claims to the company’s remaining assets, according to new court filings.
Venture capital firm Paradigm is stepping into the high-stakes legal battle involving Roman Storm, co-founder of crypto mixer Tornado Cash, urging the court to clearly define what it means to operate a money-transmitting business.
Crypto investigator ZachXBT has raised serious concerns about WhiteRock (WHITE), an emerging altcoin project he claims may be a rebranded extension of the disgraced Zkasino scheme.
A late-night distress call has exposed a sizeable cryptocurrency heist, according to 23pds, chief security officer at blockchain-forensics firm SlowMist.