Decentralized Finance (DeFi) platform Penpie, built on the Pendle network, reportedly suffered a major exploit on September 3, 2024.

According to the real-time on-chain monitoring system Cyvers Alert, the hack led to the loss of at least $26 million in various wrapped and synthetic crypto assets.

Details of the Attack Emerge

The security surveillance company stated that the attack on Penpie was initiated by a smart contract that had been initially funded to the tune of 10 ether (ETH) via Tornado Cash.

The affected protocol later acknowledged the breach, saying that it had experienced a “security compromise.” The team behind the project also informed users that all transactions had been stopped and that they were working on addressing the issue.

Pendle, on which the drained platform operates, also took to social media, stating that it had identified the attack. It also assured users that after carrying out “thorough investigations,” it had concluded that its own funds were safe. However, as a precaution, the network also paused all contracts and offered assistance to the Penpie team to help resolve the incident.

Defensive Measures and Post-Mortem

The platform later released an initial post-mortem report, detailing the timeline of events that occurred before, during, and after the incident.

In the report, the Pendle team divulged that their system flagged the contract suspected to be behind the theft immediately after it was deployed, as it had been funded from Tornado Cash.

They immediately went on high alert, scrutinizing the contract’s potential security threat against the network. It was at that time that the Penpie exploit happened, causing the Pendle team to initiate defensive measures to protect the network and its broader ecosystem against any follow-up attacks.

The protocol also enlisted the help of