On September 3, 2024, a serious security incident occurred with Penpie – an independent DeFi protocol built on the Pendle platform, resulting in the theft of $27 million in customer funds.
According to a report from PeckShield, the Penpie attacker's wallet address transferred 1,000 ETH (equivalent to approximately $2.44 million) to TornadoCash. Currently, approximately 1.011 million stolen ETH (equivalent to approximately $24.7 million) is still in the wallet address 0x2f2d…1C39. In response to this situation, Penpie had to suspend all deposits and withdrawals as a precautionary measure.
According to the official information, Pendle has announced that all contract operations have been restored and trading can proceed normally. The security vulnerability is limited to Penpie and funds on Pendle are safe.
The Penpie team is currently drafting a post-incident report and will release it soon to provide more details.
