Orion Protocol was exploited via inadequate access control in the PredyPool contract's trade() function. Attackers manipulated the liabilities array and drained liquidity from trading pairs using flash loans.

According to the SlowMist security team, the liquidity aggregator protocol Orion's contract was attacked, resulting in a loss of approximately $616,000.