Odaily News Penpie released a report on the hacker attack, with a total of 11,113.6 ETH worth approximately $27.34 million stolen. The attacker exploited a security vulnerability on the Penpie platform to maximize rewards by manipulating a fake Pendle market. The vulnerability is located in the batchHarvestMarketRewards() function of the PendleStakingBaseUpg contract. The attacker manipulated the reward tokens and their quantity by reentering the depositMarket() function and repeatedly adding new deposits from flash loans. The Penpie team responded quickly, suspended deposit and withdrawal functions, and worked with multiple security agencies to track the stolen funds. At present, the Penpie front end has been restored, and the team is working with law enforcement agencies to identify and arrest the attacker. In addition, the Penpie team is developing a compensation plan to fairly resolve the losses of affected users.