Digital Asset
Intelligence
Security Incident · Polkadot Ecosystem

Akropolis Reentrancy Attack: $2.03M Reported Loss

·Historical incident record

Incident Overview

Hackers took advantage of the storage asset verification flaws in the Akropolis project of the Polkadot ecosystem to launch multiple consecutive reentry attacks on the contract, causing the Akropolis contract to issue a large number of pooltokens out of thin air without new asset injection, and then reuse these pooltokens. Withdrawing DAI from the YCurve and sUSD pools resulted in the loss of 2.03 million DAI in the project contract.

Sources & References

Original incident referencehttps://cointelegraph.com/news/akropolis-defi-protocol-paused-as-hackers-get-away-with-2m-in-dai (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodArbitrage attack
    Reported loss$ 3,000,000
  2. Incident date
    Attack methodAffected by ChainSwap Attack
    Reported loss$ 414,013
  3. Incident date
    Attack methodContract Vulnerability
    Reported loss$ 42,373
  4. Incident date
    Attack methodFlash loan attack
    Reported loss$ 6,000,000
  5. Incident date
    Attack methodFlash loan attack
    Reported loss$ 3,300,000