According to The Defiant, the revenue generating protocol Penpie suffered a **art contract vulnerability attack today (4th), resulting in the theft of up to $27 million in funds.

Penpie is a decentralized finance (DeFi) protocol built on the basis of Pendle Finance, a revenue aggregation protocol for liquid collateral derivatives (LSD). According to cybersecurity company Cyvers, an address that received funds through the cryptocurrency mixing protocol Tornado Cash executed malicious transactions. The asset types hacked by Penpie include Lido's wstETH, Ethena's sUSDe, and Swell's rswETH.

Penpie suspended the platform's deposit and withdrawal functions, and Pendle confirmed the hacking incident and stated that the team immediately suspended contracts on Pendle after the incident to prevent hackers from stealing more funds from Penpie. Before the deadline, Pendle has released an event analysis report and stated that the relevant vulnerabilities have been mitigated through coordinated efforts from multiple parties. Currently, the **art contracts on Pendle have resumed operation.

Pendle wrote on the social media platform, "Our development team confirms that Pendle's contract is secure, and the attack was caused by a unique issue with Penpie. The vulnerability is related to a special feature that allows the Pendle marketplace to be listed on Penpie without permission

Penpie expressed his willingness to negotiate with the hackers, hoping to retrieve the stolen funds through exchange conditions such as bounties. However, the on chain information tracked by Cyvers shows that the exploit of Penpie has deposited approximately $7 million in assets into the cryptocurrency mixer Tornado Cash.

According to DeFiLlama's data, Penpie's total locked value (TVL) reached $136 million before being hacked. Affected by this incident, Penpie's native token PNP has fallen 34.7% in the past 24 hours, with a trading price of approximately $0.97 as of the deadline. And Pendle's TVL has reached $2.4 billion, ranking 11th in the DeFi field.