Advertisement
New Zealand markets closed
  • NZX 50

    12,105.29
    +94.63 (+0.79%)
     
  • NZD/USD

    0.5981
    -0.0024 (-0.41%)
     
  • NZD/EUR

    0.5537
    -0.0006 (-0.10%)
     
  • ALL ORDS

    8,153.70
    +80.10 (+0.99%)
     
  • ASX 200

    7,896.90
    +77.30 (+0.99%)
     
  • OIL

    83.00
    +1.65 (+2.03%)
     
  • GOLD

    2,241.90
    +29.20 (+1.32%)
     
  • NASDAQ

    18,240.29
    -40.55 (-0.22%)
     
  • FTSE

    7,952.62
    +20.64 (+0.26%)
     
  • Dow Jones

    39,783.07
    +22.99 (+0.06%)
     
  • DAX

    18,492.49
    +15.40 (+0.08%)
     
  • Hang Seng

    16,541.42
    +148.58 (+0.91%)
     
  • NIKKEI 225

    40,168.07
    -594.66 (-1.46%)
     
  • NZD/JPY

    90.4970
    -0.2830 (-0.31%)
     

Harvest Finance: $24M Attack Triggers $570M ‘Bank Run’ in Latest DeFi Exploit

An arbitrage trade exploiting weak points in decentralized finance (DeFi) protocol Harvest Finance led to some $24 million in stablecoins being siphoned away from the project’s pools on Monday, according to CoinGecko.

According to reports, an attacker used a flash loan – a technique that allows a trader to take on massive leverage without any downside – to manipulate DeFi prices for profit. The exploit sent the platform’s native token, FARM, tumbling by 65% in less than an hour, followed by the project’s total value locked (TVL), which dropped from over $1 billion before the exploit to $430 million as of press time.

The funds were eventually swapped for bitcoin (BTC), but not before being swept through Ethereum mixing service Tornado Cash.

Related: First Mover: Bitcoin Surges to New 2020 High as Harvest Debacle Provides Costly DeFi Lesson

ADVERTISEMENT

Read more: Harvest Finance Token Plummets 65% After Attack Saps DeFi Site of TVL

Mixing the coins didn’t keep the Harvest Finance team in the dark for long. The person behind the exploit “is well-known in the crypto community” after leaving “a significant amount of personally identifiable information,” according to the project’s Discord. All seven bitcoin wallets holding the attacker’s funds are also known.

The anonymous developers behind the project do not want to doxx the party but are instead offering a $100,000 bounty for convincing the attacker to send back the funds.

“For the attacker: you’ve proven your point, if you can return the funds to the users, it would be greatly appreciated by the community, including many bystanders,” the team said via Discord.

Flash loans strike again

Related: Kraken CEO Jesse Powell Issues Tough Critique of 'Reckless' DeFi Launches

The exploit itself was executed by a series of arbitrage trades between DeFi protocols Uniswap, Curve Finance and Harvest Finance, according to Etherscan. The attacker began by taking out a $50 million USDC flash loan from Uniswap. Then they began swapping between USDC and tether (USDT) to cause the two tokens’ prices to swing wildly.

The price of USDT began to drop on Harvest Finance as the attacker swapped tokens back and forth. The attacker then swapped discounted USDT for stablecoins taken out in the flash loan. The attacker performed the act multiple times. Each successful swap was then turned into ether (ETH) then tokenized bitcoin (WBTC and renBTC, in that order) and then finally BTC, according to Zerion.

Read more: Uniswap, Curve Daily Trading Volumes Surges Past $2B, Likely Driven by Harvest Attack

Interestingly, some $2.5 million was sent back to the Harvest Finance contract. The developer team said the funds would be distributed pro rata to affected users. The token’s price has slightly rebounded, down 49% in 24 hours to $126.82, according to CoinGecko.

The exploit joins a grouping of similar flash loan–based arbitrage trades conducted against DeFi applications in 2020. For example, lending platform bZx was the first to be hit by a flash loan exploit in February 2020.

Related Stories