JPEG’d Hacked for $11 Million, JPEG Token Price Dumps 40%

the security firm Peckshield reported that JPEG’d, an NFT lending project, suffered a significant hack resulting in losses of 6,106 WETH, valued at over $11 million.

Initial analyses suggested the attack was executed via a read-only reentrancy vulnerability. This method involves repeatedly executing withdrawal commands before the oracle updates the balance, allowing the attacker to manipulate the platform’s price reference system.

This attack method has gained traction recently, being linked to other significant hacks such as Conic Finance ($3.2 million), Era Lend ($3.4 million), and Sturdy Finance ($800,000).

The JPEG token's price experienced a sharp drop of up to 40% following the news of the hack.

Update:

Further investigation revealed that JPEG’d was not directly attacked. Instead, the funds were siphoned from the pETH/ETH pool on Curve Finance due to a vulnerability related to the Vyper programming language.

JPEG Price Movement in the Last 24 Hours:

Screenshot from CoinMarketCap as of 8:55 PM, July 30, 2023