Harvest Finance got hacked, $24 million lost
- One of the largest yield-farming protocols has been hacked.
- The team is working on the issue to mitigate the economic consequences of the incident.
The creators of the DeFi protocol Harvest Finance confirmed that their liquidity pools have been hacked. While the attack details are still under investigation, the team explained that the criminals used the flash loan attacks scheme, repeatedly manipulating prices on one money lego to drain another lego. The whole thing took only seven minutes from start to finish.
According to the preliminary data, about $24 million were stolen and cashed out via renBTC and tornado within an hour after the hack. However, later the attacker returned $2,478,549.94 to the deployer. The team plans to distribute these funds among the affected depositors.
Like other recent flash loan attacks, the attacker sent back $2,478,549.94 to the deployer in the form of USDT and USDC.
— Harvest Finance (@harvest_finance) October 26, 2020
This will be distributed to the affected depositors pro-rata using a snapshot
Later on, the team announced that the exploiter had left a lot of personally identifiable information along with the trackable BTC address. They claim that the hacker is a well-known personality in the crypto universe and ask him to return the funds to the protocol users.
For the attacker: you've proven your point, if you can return the funds to the users, it would be greatly appreciated by the community, including many bystanders watching DeFi from afar
— Harvest Finance (@harvest_finance) October 26, 2020
The full report of what has happened will be published in about 16 hours along with the strategies of mitigating risks of future flash loan attacks.
"Another rug pulled from DeFi industry"
Haechi Labs and PeckShield audited the protocol's smart contracts; however, it is unclear whether a smart contract vulnerability resulted in the hack. The users were frustrated by the low-security level of the liquidity pools. Many of them have already reported losses and expressed hope that they will be compensated.
Meanwhile, the hacks and the security breaches are no rate occasions in the DeFi universe. In September, another DeFi protocol bZx lost over $8 million to a hacker who used similar tactics. In June, Balance fell victim to the attacker who took about $500,000 worth of WETH and STA from the liquidity pool.
And as a popular cryptocurrency investor Alistair Milne noted, another rug has been pulled out.
FARM token drops like a stone
The price of the FARM token lost over 60% in a matter of minutes. At the time of writing, the token is trading at $97.13, down 58% on a day-to-day basis. While the price has recovered from the intraday low of $77.1, the overall sentiments remain bearish amid the lingering uncertainty.
FARM/USDT 1-hour chart
Meanwhile, the journalist and crypto researcher Larry Cermak noticed a sharp increase in Uniswap's trading volume, which is no wonder, considering that Uniswap accounts for over 99% of the total FARM trading volume. The expert believes that the attacker might have cashed out through the protocol.
Author
Tanya Abrosimova
Independent Analyst
