Furucombo was drained via a 'evil contract' trick where the attacker registered a malicious Aave V2 implementation, stealing approved tokens from users.
The attacker tricked Furucombo's proxy contract into thinking a malicious contract was a legitimate Aave V2 implementation. The proxy delegatecalled to the evil contract, which then used existing token approvals that users had granted to Furucombo to drain their wallets. All affected users had previously approved Furucombo to spend their tokens.
Stolen tokens immediately swapped to ETH via Uniswap and deposited to Tornado Cash. Furucombo team published a full post-mortem and issued COMBO tokens as partial compensation. The attacker profited approximately $14M net after flash loan costs. No attacker identification made. Funds laundered via Tornado Cash.
0x6a14a3a6ea286c9ccdcd51c4e7b4b8efebe7c72e58dfc6bb0d2d72b1ddc6af4a