Washing Crypto Becomes A Bigger Problem After Recent $15M Exploit

Washing crypto becomes a bigger problem after the recent $15 million exploits on the Inverse Finance defi platform where the hacker washed the stolen funds through Tornado Cash as we reproted previously in our crypto news.

Inverse Finance is the latest victim of a DeFi exploit that resulted in the loss of $15 million while the blockchains security firm Peckshiled was the first to notice, posting on Twitter “Hi, @InverseFinance, you may want to take a look,” with a link to the transaction.

Another day, another TWAP oracle manipulation

Notes:
1. TWAP time sample was too short
2. DEX liquidity significantly thinner than CEX liquidity
3. On-chain arb opportunities removed by attacker
4. CEX-DEX arb did not occur
5. Market-wide price not as affected as DEX pricing https://t.co/qSgpzAKGxS

— ChainLinkGod.eth (@ChainLinkGod) April 2, 2022

Over the past few hours, the exploiter sends hundreds of ETH transactions to Tornado Cash which is a standard tool among hackers that try to obfuscate their transaction history. They described it as a tool that improves transaction privacy and breaks the link between the destination addresses and the source. The platform uses a smart contract that accepts ETH deposits that a different address can withdraw.

The users generate a random key and deposit ETH with the note so the user then provides a proof of key to note from another wallet to withdraw the coins which breaks the transaction chain. The exploit involved a TWAP oracle that requires manipulating the price of governance token of the proejct with low liqudity. TWAP stands for time Weighted Average Price and is constructed by reading the price from an ERC20 token pair at the start and end of the desired interval.  The difference in price can be divided by the length of the interval to create a TWAP for the period of time.

Washing crypto however has become a huge issue in recent times. Inverse Finance was only one in the line of attacked platforms. They posted on Twitter to speak about the exploit and they explained how all decisions go through the on-chain governance of the DAO but the team seemed quite calm and even described the oracle manipulation very simply and correctly. What is more important is that the people responsible for the actions are not hackers as some think.

DEFI involves a lot of moving parts that are less than five years old and the excitement for these projects is quite high so the investors are willing to deposit more funds in the hope of enjoying outsized gains. The governance token of Inverse finance has a daily average volume of $900,000 with a market cap of $31 million so the volume is up 5000% today because of the exploit.