Value DeFi Hack - May 7, 2021 ($11M)
Overview
The incident with Value DeFi occurred on May 7, 2021. The AMM called vSwap from Value DeFi was exploited, with about $11M stolen from non 50/50 pools, in addition to $6M already lost that week as a result of contract reinitialization.
Attack Mechanism
The attackers exploited the Bancor formula by sending a small amount of a second token to pair addresses and then swapping it for the digital asset, allowing them to withdraw a small amount of the first token and a lot of the second token. Since Uniswap doesn't accept pools with a non 50/50 asset ratio, ValueDefi was using the Bancor formula.
A total of 9 out of the 16 pools were exploited by the scammers.
Sources