Impossible Finance was attacked via flash loan when an attacker created a fake token (AAA/BBB) to manipulate liquidity pool prices. The attacker extracted 229.84 ETH (~$500K) through multiple swaps at artificial prices.

Impossible Finance, the DeFi protocol on the BSC chain, was attacked by a lightning loan, and the attacker made a profit of 1,510.75 WBNB (a total of US$497,000). On June 25, the attackers refunded approximately $252,000. The core of this attack is that the K value check is not performed in the cheapSwap function, which causes the attacker to obtain additional tokens by performing multiple exchange operations in one exchange process.