Furucombo exploited February 27, 2021 for ~$14M via delegatecall hijack. Attacker deployed a fraudulent contract impersonating Aave v2 implementation. Furucombo failed to authenticate the target, allowing the attacker to drain pre-approved tokens (3,900+ stETH and USDC) from ~22 users.

The agent of the DeFi platform Furucombo was attacked and the amount stolen amounted to more than 15 million U.S. dollars. The DeFi aggregation platform Furucombo officially released a tweet, saying: "The root cause has been found and the vulnerability has been patched. The funds are now safe. We are investigating the stolen funds and organizing follow-up actions. The follow-up will continue to be updated."Later, Furucombo stated that it would issue 5 million iouCOMBO tokens to affected users