Defi Protocol LI.FI Struck by $8M Exploit

Security firm Decurity claims the exploit involves the LI.FI bridge.

$5.8 million worth of ether and several million worth of stablecoins was suspiciously withdrawn.

Decentralized finance (DeFi) platform LI.FI protocol has been hit by a roughly $8 million exploit following a series of suspicious withdrawals, on-chain data shows.

“Please do not interact with any LI.FI powered applications for now.” LI.FI wrote on X. “We’re investigating a potential exploit. If you did not set infinite approval, you are not at risk.”

LI.FI is a protocol that allows users to trade across various blockchains, venues and bridges.

The wallet containing the stolen funds holds 1,715 ether (ETH) worth $5.8 million as well as USDC, USDT and DAI stablecoins.

Crypto security firm Decurity said that the exploit involves the LI.FI bridge.

“The root cause is a possibility of an arbitrary call with user controlled data via `depositToGasZipERC20()` in GasZipFacet which was deployed 5 days ago,” Decurity wrote on X.

A report by Immunefi in May revealed that $473 million worth of crypto was lost to hacks, exploits and rug pulls in the first half of 2024.

Source