Hackers Drain DeFi Protocol Harvest Finance of $24 Million

Key Takeaways

Hackers obtained USDT and USDC stablecoins worth $24 million from Harvest Finance’s stablecoin and BTC pools.
Harvest’s governance token FARM plummeted 60% following the revelation of the hack.
$400 million in total liquidity have been drained out of Harvest Finance as liquidity providers (LPs) flee the platform.

A $24 million DeFi hack involving Harvest Finance has exposed the vulnerability of the entire DeFi ecosystem.

Economic Exploit of Harvest Finance

Working as a yield aggregator, Harvest Finance provides liquidity to other DeFi pools to obtain gains for its liquidity providers (LPs). Hackers allegedly leveraged this mechanism in Curve’s Y pool for their attack.

The economic attack was performed through the curve y pool, stretching the price of the stablecoins in Curve out of proportion and depositing and withdrawing a large amount of assets through harvest.

To protect users, we’ve pulled y pool and btc curve strategy funds to the vault

— Harvest Finance (@harvest_finance) October 26, 2020

Reportedly, arbitrage manipulation using a $50 million flash loan enabled the attackers to stretch the price of the stablecoins on Curve’s Y pool. The hackers then used the stablecoin and BTC pools on Harvest Finance to obtain a greater amount of stablecoins in exchange for the highly-priced tokens on Curve.

In less than seven minutes, the attackers drained $24 million from Harvests’ liquidity.

The total volume of trading on Curve’s USDT and USDC shot from $10 million to over $2.7 billion during the exploit.

The nature of the attack has been discussed in detail in the academic paper by researchers from Imperial College London (ICL). It outlines how to use flash loans to manipulate the price of token pairs and drain liquidity from DeFi pools.

A New DeFi Hack, Every Day

There is a stark similarity between the Harvest Finance hack with a previous $15 million DeFi attack on Eminence in that the attackers returned a portion to the lead developer’s address.

While it was 50% of the amount with Eminence, this time, Harvest hackers sent back 10% of the total hack to the ETH deployer address. This raises suspicions around a signature move by a single entity or a trend adopted by developers.

“The attacker” sent some funds back because they’re such nice people. If this isn’t strong evidence that “the attacker” and “the devs” are the same then I don’t know what is. https://t.co/lNcE2DkcA6

— Riccardo Spagni (@fluffypony) October 26, 2020

As reported earlier, the anonymous developers of Harvest Finance have raised several red flags. The anonymity in DeFi is also adding to the developer’s advantage, who goes untraced and richer in crypto money from the hacks.

The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.

You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.

See full terms and conditions.

290 Hacks Have Robbed the Crypto Industry of $13 Billion, Says Researc…

Crypto hackers have looted the industry of more than $13 billion in 290 different hacks, according to blockchain security firm Slowmist. As the market enters bullish territory and the size…

Understanding Position Sizing

Let’s briefly examine the most important aspect of any trading system, position sizing, or specifically how much we will bet on any one given trading idea.

KuCoin Exchange Reopens Bitcoin, Ethereum Withdrawals After $281M Hack

Following the $281 million KuCoin hack two weeks ago, the exchange blocked all deposits and withdrawals. Now, it seems that their new security measures are in place as they restart…

2,388 ETH Estimated Lost in bZx’s Second Exploit

bZx, the DeFi protocol on the receiving end of the ecosystem’s latest exploit, has been hit with a second attack, this time using the protocol’s own flash loans that were…

Credit: Source link