Pine Protocol was exploited via a flaw where old and new contract versions shared the same liquidity pools. An attacker used this to borrow NFT collateral from the new pool while recording repayment as a flash loan, allowing them to drain vault assets repeatedly across multiple transactions.

PineProtocol seems to have been exploited. According to SlowMist's analysis, the exploiter's IP is 116.*.*.112. The exploiter has withdrawn ETH from FixedFloat and ChangeNOW, and has transferred 20 ETH to TornadoCash. The exploiter appears to have received part of the bounty.