Polkadot’s decentralized finance (DeFi) hub Acala suffered an attack on its newly launched liquidity pool on Sunday. Acala has become the latest DeFi protocol to be attacked as hackers minted 1.2 billion aUSD from thin air. Immediately after the hack, the Acala team tweeted that the exploit originated from a “misconfiguration of the iBTC/aUSD liquidity pool.” The misconfiguration has now been fixed, according to the team.

Onchain data shows that most of the stablecoins minted by the attacker are still in the Acala account. The attacker swapped a small fraction of the stablecoins for five other tokens including Acala’s native token ACA. Presently, the account is holding about $1.27 billion worth of aUSD, representing more than 99% of the minted tokens.

While the Acala community decision makers are yet to make a final decision on the exploit, the team noted that it had suspended all the accounts involved in the exploit from transferring the minted tokens. According to the project, on-chain activities have also been paused for all users until further notice. The protocol noted that its oracle pallet was also paused, so users don’t have to worry about forced liquidation.

Although Acala has rectified the misconfiguration, the incident joins the number of decentralized applications (dApps) that have fallen victim to hackers who are always on the lookout for smart contract bugs they can exploit. The founder of Analog (a layer-0, proof-of-time (PoT)-based project) – Victor Young, noted that Polkadot is “secure by design” because of its relay chain, but the same cannot be said about connected parachains.

He said “In my view, we’ll continue to see more of these attacks because many dApp developers don’t put in the legwork when defining their code’s security properties. Even if the smart contract is audited, the code may not be foolproof. In this regard, developers and QA experts need to continuously evaluate to ensure the code achieves its objectives,” he said. Meanwhile, the first stablecoin on Polkadot – aUSD, negatively reacted to the incident. aUSD dropped by almost 50% to a trading price of $0.57 and was trading at $0.89 at press time.

Featured Image Source: www.thecoin.news