cryptojournalist
Decentralized exchange Clipper announced a $450,000 hack on Dec. 1, attributing the loss to a withdrawal vulnerability rather than a private key breach. Two liquidity pools were affected, accounting for 6% of Clipper’s total value locked (TVL). Other pools were untouched, and the exploit has been stopped.
The flaw involved withdrawing funds in a single token through a bundled swap and deposit. Clipper has disabled this function to prevent further attacks.
Rejecting Private Key Leak Theories
Clipper refuted claims of a private key compromise, explaining that its security design rules out such issues.
However, security expert Chaofan Shou suggested an API vulnerability might have enabled the hacker to manipulate deposit and withdrawal transactions.
Recovery Efforts
Swaps and deposits have been suspended, but withdrawals remain active with conditions. Clipper is tracking the stolen funds and has invited the hacker to negotiate.
GIPHY App Key not set. Please check settings