NFT lending platform Gondi says it will reimburse users who lost assets after a smart contract vulnerability allowed an attacker to withdraw roughly $230,000 worth of NFTs.
The issue was traced to the platform’s Sell & Repay contract, a feature that lets borrowers sell NFTs held in escrow and then settle their outstanding loans. Gondi confirmed the attacker used this flaw to pull assets directly from the contract.
The company has since disabled the affected function while working on a fix. Other parts of the platform remain operational.
“All users who interacted with this contract and were impacted have been contacted directly by our team,”
Gondi wrote.
To resolve the situation, the platform plans to purchase similar NFTs from the same collections and return them to affected holders. While the exact pieces may differ, the goal is to restore the value lost during the incident.
After the exploit, security firm Blockaid reported that some of the stolen NFTs were quickly sold, while others remained in the attacker’s wallet. Several ended up with buyers who were unaware of the incident.
“We reached out to each of them directly and asked for their help in returning the items to their rightful owners.”
So far, members of the community have helped recover a handful of assets, including Aluminum Gazer, Servant of the Muse, Doodle, and Lil Pudgy. Gondi says it is using protocol fees to buy back items when possible and compensate affected users.
Disclaimer: This content does not constitute trading or investment recommendations. It’s essential to conduct your own research before purchasing any cryptocurrency or investing in any services.
