Fantasm Finance's mint function validated msg.value instead of the actual FTM amount transferred, allowing attackers to mint XFTM without collateral. The attacker drained the reserve of 1,008.5 ETH (~$2.62M), swapped it through Tornado Cash, and XFTM fell ~98%.

Fantom’s on-chain synthetic asset protocol, Fantasm Finance, posted on social media that its FTM collateral reserves had been exploited, and called on users to exchange their XFTM immediately. After exploiting the vulnerability, the hacker exchanged all the profits for ETH, and used Tornado.cash to mix coins across the chain to the Ethereum main network. According to statistics, the hacker made a profit of 1,007 ETH (about 2.73 million US dollars).