NGP Protocol Hacked: $2M Stolen, Tornado Cash Used

NGP protocol on BNB Chain was exploited in a flash loan to the tune of $2M. Fraudulently accessed funds were transferred via Tornado Cash, which struck the token price and sounded a security alarm.

An exploit of the NGP protocol in the BNB Chain cost the chain two million dollars. The stolen money was laundered via Tornado Cash, which brought a question to crypto users

Later transferred to the Ethereum network. The money is kept in a probable money laundering address.

Inside the Flash Loan Attack and Price Oracle Exploit

The exploit was based on a severe weakness in the price oracle of NGP. The getPrice function of the contract relies only on the reserves of one Uniswap V2 pool

This spot price feed is not secure, and it can be corrupted in a single atomic transaction.

Hackers took advantage of this vulnerability by obtaining a huge loan in tokens. They then exchanged tokens in order to inflate the USDT stocks and deflate the NGP stocks in the liquidity pool

The exploit transaction is publicly tracked on BSCScan, the address of the victim and the exploiter as well

The wallet of hacker was funded through Tornado Cash, a privacy mixer, which made it difficult to trace the hacker. The utilization of Tornado Cash is an indication of a high-order laundering.