Cyber Incident Victim: Fortress
Date:
May 2022
Location:
United States of America
Summary
A decentralized finance protocol suffered a $3 million cryptocurrency theft due to an oracle manipulation attack that exploited third-party infrastructure vulnerabilities. Attackers hijacked the price feed mechanism to alter the value of the platform's native token, enabling them to drain funds comprising 1,048.1 Ethereum and 400,000 DAI stablecoins before laundering proceeds through Tornado. The incident caused the native token's value to plummet over 45% and disrupted lending operations, with security analysts attributing the breach to inadequate oracle verification protocols—a flaw previously exploited in a similar $15 million attack against another DeFi platform. The involved oracle provider acknowledged potential feed errors and deployed emergency fixes while investigations continued.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 8, 2022, decentralized finance protocol Fortress announced via Twitter that approximately $3 million in cryptocurrency had been stolen through an attack targeting third-party infrastructure. The protocol, operating on the Binance Smart Chain as a money-market and stablecoin platform, attributed the incident to an oracle manipulation attack that drained all its funds. Attackers stole 1,048.1 Ethereum and 400,000 DAI stablecoins before funneling the assets through Tornado, a cryptocurrency mixing service designed to obscure transaction trails. Fortress urgently advised users to cease supplying assets to the platform while investigations continued, sharing blockchain addresses associated with the attack initiation and fund transfers. The value of Fortress’s native token (FTS) plummeted over 45% following the breach, according to Coinbase data.
Blockchain security firms PeckShield and BlocSec analyzed the attack, identifying a critical vulnerability in Fortress’s oracle system that lacked proper verification controls, enabling unauthorized price manipulation. The attacker exploited this flaw to artificially alter FTS token prices, then purchased 296,193 FTS tokens for $8,000 to vote for a malicious proposal adding FTS as collateral. This method mirrored a $15 million oracle manipulation attack on Inverse Finance in April 2022. PeckShield alerted Umbrella Network, the oracle provider implicated in the incident, which acknowledged a potential price feed error and deployed a hotfix after internal and external verification. Fortress’s parent company, Jetfuel Finance, disabled supply and borrow functions on the Fortress Loans app as a containment measure but confirmed existing smart contracts remained operational. PeckShield noted the incident contributed to 2022’s cumulative DeFi thefts exceeding $1.57 billion by May 1, surpassing 2021’s full-year total of $1.55 billion. Fortress appealed to partners and community organizations to assist in freezing and recovering the stolen assets.