Paribus was exploited through a reentrancy vulnerability in a Compound V2 fork, where the transfer occurred before storage updates. An attacker used flash loans and the reentrant redeem function to borrow against collateral twice, draining USDT, WBTC, and ETH.

Paribus, the first cross-chain lending platform on Cardano, was attacked and lost about $100,000. The reason for the attack is that it uses a fork of an old version of Compound V2, which has a known reentrancy vulnerability.