Reentrancy, price oracle attacks and exploits across seven protocols caused the decentralized finance (DeFi) space to bleed at least $21 million in crypto in February. 

According to DeFi data analytics platform DefiLlama, one of the largest in the month was the flash loan reentrancy attack on Platypus Finance, which led to $8.5 million of funds lost.

DefiLlama highlighted six other noteworthy hacks in the month, the first being the price oracle attack on BonqDAO on Feb 1.


DeFi platforms suffered seven attacks throughout February. Source: DefiLlama

BonqDAO: $1.7 million

BonqDAO revealed to its followers in a Feb. 1 post that its Bonq protocol was exposed to an oracle attack that allowed the exploiter to manipulate the price of the AllianceBlock (ALBT) token.

The exploiter increased the ALBT price and minted large amounts of Bonq Euro (BEUR). The BEUR was then swapped for other tokens on Uniswap. Then, the price decreased to almost zero, which triggered the liquidation of ALBT.

Blockchain security firm PeckShield estimated the losses to be around $120 million; however, it was later revealed hackers reportedly only cashed out around $1 million due to a lack of liquidity on BonqDAO.

Orion Protocol: $3 million

Just a day later, on Feb. 2, decentralized exchange Orion Protocol suffered a loss of roughly $3 million through a reentrancy attack, where attackers used a malicious smart contract to drain funds from a target with repeated withdrawal orders.

Orion Protocol CEO Alexey Koloskov confirmed the attack at the time, assuring everyone that “All users’ funds are safe and secure.“

"We have reasons to believe that the issue was not a result of any shortcomings in our core protocol code, but rather might have been caused by a vulnerability in mixing third-party libraries in one of the smart contracts used by our experimental and private brokers," he said.

dForce network: $3.65 million

DeFi protocol dForce network was another February victim of a reentrancy attack resulting in losses of around $3.65 million.

In a Feb. 10 post, dForce confirmed the exploit; however in a twist, all funds were returned when the hacker came forward as a whitehat hacker.

“On Feb. 13, 2023, the exploited funds were fully returned to our multi-sig on both Arbitrum and Optimism, a perfect ending for all,” dForce said.

Platypus finance: $9.1 million

On Feb. 16, DeFi protocol Platypus Finance suffered a flash loan attack resulting in $8.5 million being drained from the protocol.

A post-mortem report from Platypus auditor Omniscia noted that the attack was possible because of code in the wrong order.

On Feb. 23, the team announced that they are seeking to return around 78% of the main pool funds by reminting frozen stablecoins.

The team also confirmed second and third incidents, which led to another $667,000 exploited, bringing total losses to around $9.1 million.

French police arrested two suspects related to the hack and seized around $222,000 worth of crypto assets on Feb. 25.

Hope finance: $1.86 million

A few days later, users of arbitrum-based algorithmic stablecoin project, Hope Finance, fell prey to a smart contract exploit on Feb. 20, which saw roughly $2 million stolen from users.

Web3 security firm CertiK flagged the incident on Feb. 21, following an announcement from the Hope Finance Twitter account notifying users of the scam.

A member of the CertiK team told Cointelegraph at the time that the scammer had changed the details of the smart contract, which led to funds being drained from Hope Finance genesis protocol:

It appears that the scammer changed the TradingHelper contract which meant that when 0x4481 calls OpenTrade on the GenesisRewardPool the funds are transferred to the scammer.

Dexible: $2 million

Multichain exchange aggregator Dexible was hit by an exploit that targeted the app’s selfSwap function, with $2 million worth of cryptocurrency lost as a result of the Feb. 17 attack.

According to a Feb. 18 post from the exchange, “a hacker exploited a vulnerability in our newest smart contract. This allowed the hacker to steal funds from any wallet that had an unspent spend approval on the contract.”

After investigating, the Dexible team found the attacker had used the app’s selfSwap function to move over $2 million worth of crypto from users that had previously authorized the app to move their tokens.

After receiving the tokens into their own smart contract, the attacker withdrew the coins through Tornado Cash into unknown BNB wallets.

LaunchZone: $700,000

BNB Chain-based DeFi protocol LaunchZone had $700,000 worth of funds drained on Feb. 27.

According to blockchain security firm Immunefi, an attacker leveraged an unverified contract to drain the funds.

"An approval had been made to the unverified contract 473 days ago by the LaunchZone deployer," Immunefi said.

The February figures are a stark increase from January, according to DefiLlama figures.

The tracker lists only $740,000 in hacks to DeFi platforms in the month across two protocols — Midas Capital and ROE Finance.

In its 2023 Crypto Crime Report, blockchain data firm Chainalysis revealed that hackers stole $3.1 billion from DeFi protocols in 2022, accounting for more than 82% of the total amount stolen in the year. 

Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers.

Join Telegram

Recommended content

Recommended Content

Editors’ Picks

Bitcoin active addresses hit lowest level in five years, BTC ranges below $67,000

Bitcoin active addresses hit lowest level in five years, BTC ranges below $67,000

Bitcoin (BTC), the largest asset by market capitalization, has noted a decline in its active address count per data from Glassnode. A decline in active addresses is typical at a time during a surge in Bitcoin transaction fees.

More Bitcoin News

SEC vs. Ripple lawsuit update: Regulator responds to letter regarding Terraform Labs judgment

SEC vs. Ripple lawsuit update: Regulator responds to letter regarding Terraform Labs judgment

Securities and Exchange Commission (SEC) responded to Ripple’s letter that quotes the reasons for the settlement amount being unreasonable. The payment firm had proposed a fine of $10 million, as opposed to the SEC’s $2 billion. 

More Ripple News

Gemini Earn creditors could recover their funds in coin as New York Attorney General recovers $50 million

Gemini Earn creditors could recover their funds in coin as New York Attorney General recovers $50 million

Gemini exchange had terminated its Earn program after Genesis Global Capital did not return over $900 million in assets that it owed to the platform. New York Attorney General Letitia James’ office has recovered a total of $2.05 billion from the platform.

More Cryptocurrencies News

Here’s what you need to know about LayerZero ZRO token airdrop

Here’s what you need to know about LayerZero ZRO token airdrop

LayerZero Labs CEO Bryan Pellegrino released details of the upcoming ZRO token airdrop in a recent tweet. ZRO total supply is 1 billion of which 23.8% will be directly allocated to the community and builders. LayerZero announced June 20 as a key date, it remains unclear whether this is the airdrop or entitlement date. 

More Zro News

Bitcoin: Has BTC found a local price bottom?

Bitcoin: Has BTC found a local price bottom?

Bitcoin (BTC) price looks set for a mild fall this week, weighed by slight outflows in the US spot ETFs and the US Fed keeping a hawkish interest-rate outlook despite easing inflation. Technical indicators suggest that BTC could face a further 5% correction in the short term before resuming the uptrend.

Read full analysis