Attackers withdrew about $2.1 million from a legacy vault of Thetanuts Finance as a result of yet another hack in the decentralized finance (DeFi) sector. White-hat hackers returned approximately $2 million.

The hack affected a vault that the protocol stopped using several years ago. Thetanuts emphasized that this contract is not connected to working products and current infrastructure.

Want more exclusive news and analytics? Subscribe to our Telegram channel, discuss the news and share your thoughts on the latest market events in the chat!

How the hack happened

The first to disclose the signal about the hack were companies that work on the security of blockchain projects. SlowMist found that the cause of the incident was a delegatecall error in the internal minting function of the smart contract.

After funds were withdrawn, the deposit formula began returning zero due to the specifics of rounding when dividing calls. This allowed the attacker to withdraw tokens for free. As a result, it became possible to create tokens in unlimited quantities.

According to PeckShield, the hacker exchanged $105,000 in USDC for approximately 60 Ethereum (ETH). The wallet still holds option tokens worth approximately $34,000.

Thetanuts publicly commented on the hack.

«Our first analysis shows: this initially concerns a legacy vault that we stopped working with long ago. This incident is in no way connected to active smart contracts and current products. After clarifying the details, we will publish a detailed report», — the team stated.

The Thetanuts case is part of a series of attacks on abandoned or outdated smart contracts. After all, even after support is discontinued, such contracts often continue to operate.

Earlier the BeInCrypto editorial team wrote about hackers who withdrew about $2.1 million from the Aztec Connect smart contract, which has been functioning without support for three years now. In another case, attackers stole approximately $1.3 million from outdated Raydium (RAY) liquidity pools .

Source: BeInCrypto