According to BlockBeats, on September 4, Pendle released an analysis report on the Penpie attack. “Pendle immediately suspended our contract after discovering the security vulnerability, protecting the security of approximately $105 million, which could be further lost from Penpie.
At 01:45 today, the attacker deployed the first contract used for the attack. Our real-time internal monitoring system detected it as a suspicious contract that was funded by Tornado Cash and interacted with the Pendle contract.
By 01:46 the team was aware of the red flag and remained on alert while an investigation was launched to check whether this posed a real safety threat to Pendle.
At 02:23, the first attack occurred on Penpie, a separate protocol built on top of Pendle.
At 02:25 (approximately 2 minutes after the Penpie security breach), the Pendle team was fully engaged in protecting Pendle and Pencosystem from any subsequent attacks.
At 02:34, Pendle also contacted security experts Seal 911 to help assess the situation, evaluate options, and develop appropriate strategies to prevent any subsequent related attacks.
At 02:45, we managed to suspend all contracts on Pendle. After that, the team contacted the protocols that used Pendle PT as collateral and informed them of the contract suspension.
At 02:52, our development team confirmed that the Pendle contract is secure and that the attack was caused by an issue specific to Penpie. The vulnerability was found to be related to a unique feature that allowed unauthorized listing of Pendle markets on Penpie.
At 08:50, after rigorous inspection and coordination with all relevant parties to confirm steps 1 and 2, the Pendle contract has been safely unpaused and resumed normal operation.
