Decentralized Finance protocol was attacked by a $25 million Hacker, and all assets were successfully recovered within 48 hours.

Recently, a decentralized lending protocol was attacked by hackers, resulting in the theft of approximately $25 million worth of encryption assets. After the incident, the project team quickly launched a 48-hour continuous tracking and response effort.

Attack Incident Timeline:

On April 19th at 8:58 AM, hackers began an attack on the protocol contract. By 11:32, the attack was complete, and a large amount of encryption assets were stolen. On the same day at 12:57, the related contract was urgently closed.

Team response measures:

On the day of the incident, from 11:00 to 14:00, the project team quickly contacted major stablecoin issuers, DeFi protocol teams, exchanges, and wallet partners through investors, requesting monitoring and freezing of the involved accounts. At the same time, the project team reported the cause of the attack and the status of the assets to the relevant parties.

On the afternoon of the 19th, multiple security teams gathered to form a temporary security group to begin tracking the stolen assets. At 22:12 that evening, the hacker left a message on the chain saying "Better Future". Subsequently, the hacker gradually transferred back a small amount of assets to the project party, which may be a probing action.

The project party immediately left contact information on the chain to express their willingness to communicate. At the same time, they applied to the police for a mandatory enforcement order to obtain assistance from all parties. The police then communicated directly with the relevant parties, requesting case information and monitoring accounts.

On the 20th, the security team successfully created a hacker profile based on the traces left by the hacker and obtained breakthrough clues. On that day, the hacker did not take any significant action, and the project team once again left a message on the chain calling for contact.

On the 21st at 13:33, the hacker actively communicated with the project team under pressure and began to return part of the assets. After further communication, all the stolen assets were successfully recovered.

As of the 21st at 17:00, the project party submitted a request to withdraw the case to the police since the assets have been recovered. Throughout the process, the project party did not obtain any user sensitive information.

This incident again highlights the importance of DeFi security and demonstrates the rapid response and collaborative ability of various parties in the industry when facing a crisis. In the future, strengthening security audits and improving emergency mechanisms will be important topics for DeFi projects.