Rikkei Finance lending protocol lacked permission controls in the setOracleDate function, allowing an attacker to manipulate oracle prices. With only 0.0001 BNB as collateral, the attacker borrowed all USDC, BTC, DAI, USDT, and BUSD from liquidity pools by inflating collateral value through the malicious oracle.

Metaverse DeFi protocol Rikkei Finance was attacked because the attacker changed the oracle machine to a malicious contract. Rikkei Finance said users affected by the exploit will be fully compensated, and the team said the bug is being fixed and services have been fully restored. The total loss value is approximately $1.1 million (2671 BNB).