$365 000 USD





"Ploutoz is an automated money market platform which provide 100% decentralized finance-based lending services in Binance Smart Chain." "Ploutoz allows users to efficiently lending crypto assets on the Binance Smart Chain."


"Ploutoz enables users to utilize their cryptocurrencies by as a lender, supplying collateral to the network for supporting borrower by pledging over-collateralized asset."


"Ploutoz passed [a] smart contact audit from ThaiShield by ThaiChain."


"Ploutoz Finance, the BSC loan agreement, was attacked by a flash loan attack." On November 23rd, "Ploutoz finance was exploited and it led to the gain of ~$365K for the hacker."


"The hack was made possible due to the price oracle manipulation of DOP in Ploutoz finance." "The hacker manipulated the oracle price of DOP tokens and used the manipulated DOP as collateral to borrow other assets, including CAKE, ETH, BTCB, etc." "Specifically, the hacker leverages the manipulated DOP as collateral to borrow other assets, including CAKE, ETH, BTCB, etc."


"The attacker, who remains unknown, was able to drain the liquidity pools by way of a flash loan attack. A flash loan attack is when an attacker takes out a loan from one DeFi platform or service provider and uses the borrowed money to interact with smart contracts in a way that manipulates prices of DeFi tokens in their favor so that they can subsequently drain a project’s liquidity pool at prices favorable to them."


"The initial funds to launch the hack were withdrawn from TornadoCash. The resulting gains are swapped via paraswap and PancakeSwap, then washed via TornadoCash."

Ploutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.