A hacker who attacked Tender.fi, a DeFi protocol, has returned the $1.6 million stolen on Tuesday and instead received a bug bounty of 62.15 ether ($85,000) as a reward. The hack was possible due to a pricing oracle error in Tender.fi's system, which had recently switched to using Chainlink's pricing oracle. The error allowed the attacker to trick the system into allowing infinite borrows after depositing just one GMX token worth $70. After withdrawing the stolen funds, the hacker left a message on the blockchain stating the oracle was misconfigured. Tender.fi has promised to repay any unpaid debt and plans to deploy a new rewritten oracle contract before resuming borrowing.
The TND token dropped by 34% during the hack but has since recovered slightly, trading at $1.87 and showing a 2.37% increase in the past 24 hours against its ethereum pair.