An attacker used an $81M flashloan from dYdX to manipulate SNX price downward, then exploited an access control vulnerability in xToken's callFunction to purchase SNX at artificially depressed prices, stealing $4.5M in value.

The DeFi pledge and liquidity strategy platform xToken, which suffered a lightning loan attack, released an analysis report on the vulnerability of the xSNX contract. At 4:43 UTC on August 29th, a vulnerability in the xSNX contract was exploited, and the holder's loss was estimated to be 4.5 million U.S. dollars. xToken believes that it is best to stop providing xSNX products at this time. xToken stated that it will no longer use the xSNX contract for SNX pledge.