On July 12, 2024 Dough Finance on Ethereum was exploited for approximately $1.96 million via unvalidated call data in the ConnectorDeleverageParaswap contract, where attackers combined a flashloan with the arbitrary external call vulnerability to manipulate data and transfer WETH. Stolen funds were swapped to ETH and 600 ETH (~$1.8M) was later deposited into Tornado Cash; a white-hat recovered 69.12 ETH.

Dough Finance was attacked due to a contract vulnerability. Some unauthorized funds were extracted by hackers, resulting in a loss of approximately $2.1 million. Around 76 ETH (approximately $260,000) has been returned by white hat hackers.