Hacker drains over $1m from Levana Protocol

In an X thread, Levana said the attacker succeeded in draining approximately 10% of its liquidity pools.

Decentralized finance startup Levana Protocol suffered a security exploit, resulting in a loss of $1.14 million. The project’s statement on X revealed that the exploit “began 14 days ago,” orchestrated by seven wallets believed to be controlled by a single bad actor.

Levana stated that the attacker initially drained around 4% of its liquidity providers, later escalating to an additional 5% “until the protocol was closed from new positions being opened.”

The Levana team emphasized that “most of the issues experienced by Levana with Osmosis have nothing to do with Osmosis but rather are core Tendermint and Cosmo SDK issues.” In a blog post, Levana noted that even though the Pyth oracle is a key part of the attack, there is no known vulnerability in the Pyth oracle.

“A presumed attacker was able to launch a congestion attack on the Osmosis chain to deny most Levana users the ability to interact with Levana markets for a predictable period of time, and thereby deny them the ability to update the Pyth oracle contract.”

Levana Protocol

The project clarified that the incident resulted from an “oracle attack,” which has since been fixed. Levana reassured users that “traders positions and profits are safe, closing positions are uninterrupted.” Founded in 2021, Levana Protocol is a decentralized perpetual trading protocol designed to enable leveraged positions for cryptocurrencies.