Deus DAO's lending platform was exploited via flash loan price oracle manipulation on Solidly and Spirit Finance DEXes, draining $13.4M.
The attacker used flash loans to manipulate the price of the DEI/USDC pair on Solidly and Spirit Finance DEXes on Fantom. These manipulated prices were used as oracle references by Deus DAO's lending protocol. With artificially inflated collateral value, the attacker borrowed assets far exceeding their real collateral worth, extracting $13.4M before the price snapped back.
Stolen assets converted to stablecoins and bridged from Fantom to Ethereum via Multichain. Funds subsequently deposited into Tornado Cash. Deus DAO published a post-mortem and compensated affected users through protocol treasury. A prior attack in March 2022 had drained $3M using similar oracle manipulation. No funds recovered from April attack.