Decentralized lending platform Abracadabra.Finance experienced a significant security breach, resulting in the theft of $13 million worth of cryptocurrency from its GMX-linked liquidity pools. Blockchain security firm PeckShield identified the compromised contracts, which involved both decentralized exchange GMX and Abracadabra.
The attack specifically targeted "cauldrons," which are isolated lending markets on Abracadabra that allow users to borrow against crypto collateral. These cauldrons utilized GM tokens, representing liquidity positions in GMX, a decentralized exchange platform. GMX clarified that its core contracts remained unaffected, emphasizing that the breach was confined to the Abracadabra/Spell cauldrons.
In a social media statement, Abracadabra confirmed the exploit, noting that core contributors and engineers are currently investigating the incident. The company's "fully audited" cauldrons were previously vetted by Guardian Audits, the same firm responsible for auditing GMX contracts. Abracadabra highlighted its extensive security infrastructure, including monitoring and response tools.
The platform has proposed a 20% bug bounty to the attacker and invited negotiations via email or on-chain communication. Abracadabra is collaborating with Guardian, GMX, and other security partners to assess the damage and understand the attack’s methodology. A comprehensive analysis will be published once the investigation concludes, and importantly, no user collateral was impacted.
This event follows a previous exploitation in which Abracadabra.Finance lost $6.49 million, affecting the stability of its Magic Internet Money (MIM) stablecoin.