Polter Finance suspended operations after a $12 million exploit linked to a flash loan attack on its SpookySwap market. The platform is working with law enforcement and has reached out to the hacker to recover the stolen funds.
Polter Finance Attack
Polter Finance, a decentralized platform for lending and borrowing, has suspended all operations and is seeking assistance from law enforcement following a $12 million breach that depleted its total value locked (TVL).
On November 17, Polter Finance notified its community on X that its platform’s operations had been suspended due to the discovery of an exploit. The investigation disclosed that the misappropriated funds were associated with wallets on the Binance exchange.
The breach was caused by a defective oracle pricing mechanism in a flash loan attack that targeted Polter’s newly launched SpookySwap (BOO) market, according to TenArmor, a Web3 security firm.
Nevertheless, the precise nature of the exploit has not yet been officially confirmed by Polter. To facilitate the recovery of funds, Polter utilized an on-chain message to contact the assailant, providing an opportunity to negotiate and potentially avert negative consequences.
The perpetrator has not responded as of the publication of this report. The Singaporean authorities have received a report from the founder of Polter Finance, who goes by the pseudonym Whichghost. The police verified Whichghost’s identity using Singpass, Singapore’s digital identity verification system.
The police report disclosed that Whichghost lost $223,219 in personal assets, resulting in a total of over 16.1 million Singapore dollars (approximately $12 million) in losses.
The founder emphasized that their login credentials, which included private keys, were never shared, and attributed the breach to an exploit in the freshly deployed BOO token lending smart contract.
Through a onchain message, Polter Finance engages in negotiations with the intruder. Source: Polter Finance
The BOO market’s valuation was only $3,000 at the time of the compromise, despite the fact that it enabled the attack. This is an interesting fact.
The community’s response to X was a divided bag, with some members expressing skepticism regarding the incident’s legitimacy and suggesting that it may have been the result of insider involvement. Critics contend that filing a police report may serve as an attempt to avoid scrutiny.
Polter Finance has disclosed that it is forming a partnership with the Security Alliance Information Sharing and Analysis Center (SEAL-ISAC) to trace the perpetrator of the attack.
