2023.05.01 - Level Finance

On May 1, 2023, Hypernative detected an attack targetting Level Finance on BSC. The root cause of the attack was a bug in the claim mechanism of the protocol's Referral Controller Contract. The attacker's address was funded through Tornado Cash. 214K LVL tokens were drained to the exploiter's address, and swapped to 3,345 BNB (worth ~$1M). At the time of writing, the funds remain in the attacker’s address.