Security firm Decurity claims the exploit involves the LI.FI bridge.
$5.8 million worth of ether and several million worth of stablecoins was suspiciously withdrawn.
Decentralized finance (DeFi) platform LI.FI protocol has been hit by a roughly $8 million exploit following a series of suspicious withdrawals, on-chain data shows.
“Please do not interact with any LI.FI powered applications for now.” LI.FI wrote on X. “We’re investigating a potential exploit. If you did not set infinite approval, you are not at risk.”
LI.FI is a protocol that allows users to trade across various blockchains, venues and bridges. It suffered a bug with its swapping feature in 2022, resulting in a $600,000 loss, PeckShield described the recent bug as “basically the same.”
The wallet containing the stolen funds holds 1,715 ether (ETH) worth $5.8 million as well as USDC, USDT and DAI stablecoins.
Crypto security firm Decurity said that the exploit involves the LI.FI bridge.
“The root cause is a possibility of an arbitrary call with user controlled data via `depositToGasZipERC20()` in GasZipFacet which was deployed 5 days ago,” Decurity wrote on X.
A report by Immunefi in May revealed that $473 million worth of crypto was lost to hacks, exploits and rug pulls in the first half of 2024.
UPDATE (July 16, 13:48 UTC): Adds link to 2022 exploit that resulted in a $600,000 loss.