4th Major DeFi Hack In A Month: Origin Dollar Loses USD 7m

“A superior stablecoin for the Ethereum network,” Origin Dollar (OUSD), has been hacked, becoming at least the fourth decentralized finance (DeFi) project, attacked less than in a month.

“There has been a loss of funds of around USD 7m, including over USD 1m of funds deposited by Origin and our founders and employees,” confirmed Matthew Liu, Co-Founder of Origin Protocol (OGN), a San Franciso-headquartered peer-to-peer commerce startup, that launched OUSD in September this year. OUSD automatically earns yields from DeFi protocols while it’s still sitting in a wallet.

At pixel time (05:31 UTC), OGN, ranked 256th by market capitalization, trades at USD 0.157 and is down by almost 8% in a day, trimming its weekly gains to 13%.

“We are not going away. This is not a rug pull or internal scam,” Liu said, adding that they’re “actively working on measures in an attempt to recoup the funds.” Also, they’re asking the hacker to return the funds and promised to “hire you as a security consultant” and “not to pursue you or any legal action against you.”

Liu also claims that the team has now traced funds and knows that the attacker used both Tornado Cash and renBTC to wash and move funds.

“Currently, there is still 7,137 ETH and 2.249m DAI sitting in one of the attacker’s wallets,” Liu added. According to him, the attack was a re-entrancy bug in their contract. One of the most well-known re-entrancy attacks was the DAO hack in 2016, which drained it of some ETH 3.6m, at the time valued at some USD 50m.

The Co-founder said that the attacker was able to sell some OUSD on Uniswap and Sushiswap decentralized exchanges for USDT.

“Please do not buy OUSD on Uniswap or Sushiswap as the current prices do not reflect OUSD’s underlying assets,” Liu said.

Meanwhile, just this past weekend, decentralized finance protocol Value DeFi said it lost around USD 6m due to “a complex attack”. Also last week, DeFi platform Akropolis lost some USD 2m, while in the end of October, Harvest Finance lost around USD 24m. Value Defi and Harvest later claimed that their attackers returned a portion of the stolen funds.