This was quite an elegant “attack.” This is what happened:
1) Take out a flash loan of 7,500 ETH
2) Trade 3,517 ETH on Synthetix for $940k sUSD (at price close to $1)
3) Use 900 ETH to market buy sUSD on Kyber and Uniswap to push the price to more than $2
1) Take out a flash loan of 7,500 ETH
2) Trade 3,517 ETH on Synthetix for $940k sUSD (at price close to $1)
3) Use 900 ETH to market buy sUSD on Kyber and Uniswap to push the price to more than $2
5) Borrow 6,796 ETH on bZx by using sUSD as collateral (much more than he was supposed to because price of sUSD appeared higher)
6) Use the borrowed ETH and the remaining ETH balance (6,796+3,083) to repay the flash loan (7,500) and net 2,379 ETH in profit (9,879-7,500)
6) Use the borrowed ETH and the remaining ETH balance (6,796+3,083) to repay the flash loan (7,500) and net 2,379 ETH in profit (9,879-7,500)
7) bZx ETH pool lost about $1.8M while the sUSD pool gained $1.1M. The attacker makes ~$640k
Apparently, none of the user funds have been lost. But tbh, when you start sounding like CZ and saying that everything out there is FUD and funds are SAFU, it's not the best sign in the world 
Losses will be socialized or alternatively, the team will pay it out when financially able to do so.
