Condividi questo articolo
Harvest Finance: $24M Attack Triggers $570M 'Bank Run' in Latest DeFi Exploit
Harvest Finance has seen its total value locked drop by more than $500 million in the 12 hours since being hit by a flash loan attack.
Make us preferred on Google
An arbitrage trade exploiting weak points in decentralized finance (DeFi) protocol Harvest Finance led to some $24 million in stablecoins being siphoned away from the project’s pools on Monday, according to CoinGecko.
STORY CONTINUES BELOW
According to reports, an attacker used a flash loan – a technique that allows a trader to take on massive leverage without any downside – to manipulate DeFi prices for profit. The exploit sent the platform’s native token, FARM, tumbling by 65% in less than an hour, followed by the project's total value locked (TVL), which dropped from over $1 billion before the exploit to $430 million as of press time.
The funds were eventually swapped for bitcoin , but not before being swept through Ethereum mixing service Tornado Cash.
Read more: Harvest Finance Token Plummets 65% After Attack Saps DeFi Site of TVL
Mixing the coins didn’t keep the Harvest Finance team in the dark for long. The person behind the exploit “is well-known in the crypto community” after leaving “a significant amount of personally identifiable information,” according to the project’s Discord. All seven bitcoin wallets holding the attacker’s funds are also known.
The anonymous developers behind the project do not want to doxx the party but are instead offering a $100,000 bounty for convincing the attacker to send back the funds.
“For the attacker: you've proven your point, if you can return the funds to the users, it would be greatly appreciated by the community, including many bystanders,” the team said via Discord.
Flash loans strike again
The exploit itself was executed by a series of arbitrage trades between DeFi protocols Uniswap, Curve Finance and Harvest Finance, according to Etherscan. The attacker began by taking out a $50 million USDC flash loan from Uniswap. Then they began swapping between USDC and tether to cause the two tokens’ prices to swing wildly.
No hacker.Just a simple* $24M (0x53f) juicy arb on @harvest_finance
— Julien Bouteloup (@bneiluj) October 26, 2020
$50M USDC flash loan @UniswapProtocol
Swap $11M (USDC/USDT) @CurveFinance
~61M on fUSDT Vault
Swap $11M USDT/USDC yUSDT
Withdraw $61M with $0.5M profit
Repeat & clean into @TornadoCashhttps://t.co/nFTuyU3s6w pic.twitter.com/2oXQ2PsY32
The price of USDT began to drop on Harvest Finance as the attacker swapped tokens back and forth. The attacker then swapped discounted USDT for stablecoins taken out in the flash loan. The attacker performed the act multiple times. Each successful swap was then turned into ether then tokenized bitcoin (WBTC and renBTC, in that order) and then finally BTC, according to Zerion.
Read more: Uniswap, Curve Daily Trading Volumes Surges Past $2B, Likely Driven by Harvest Attack
Interestingly, some $2.5 million was sent back to the Harvest Finance contract. The developer team said the funds would be distributed pro rata to affected users. The token’s price has slightly rebounded, down 49% in 24 hours to $126.82, according to CoinGecko.
The exploit joins a grouping of similar flash loan–based arbitrage trades conducted against DeFi applications in 2020. For example, lending platform bZx was the first to be hit by a flash loan exploit in February 2020.
Di più per voi
KuCoin captured a record share of centralised exchange volume in 2025, with more than $1.25tn traded as its volumes grew faster than the wider crypto market.
Cosa sapere:
- KuCoin recorded over $1.25 trillion in total trading volume in 2025, equivalent to an average of roughly $114 billion per month, marking its strongest year on record.
- This performance translated into an all-time high share of centralised exchange volume, as KuCoin’s activity expanded faster than aggregate CEX volumes, which slowed during periods of lower market volatility.
- Spot and derivatives volumes were evenly split, each exceeding $500 billion for the year, signalling broad-based usage rather than reliance on a single product line.
- Altcoins accounted for the majority of trading activity, reinforcing KuCoin’s role as a primary liquidity venue beyond BTC and ETH at a time when majors saw more muted turnover.
- Even as overall crypto volumes softened mid-year, KuCoin maintained elevated baseline activity, indicating structurally higher user engagement rather than short-lived volume spikes.
Di più per voi
Ethereum Foundation makes post quantum security a top priority as new team forms
EF researcher Justin Drake says a new post quantum team will drive wallet safety upgrades, research prizes and test networks as quantum timelines shorten.
Cosa sapere:
- The Ethereum Foundation has elevated post-quantum security to a top strategic priority, forming a dedicated Post Quantum team led by Thomas Coratger with support from leanVM cryptographer Emile.
- Researcher Justin Drake said Ethereum is shifting from background research to active engineering, including biweekly developer sessions on post-quantum transactions and multi-client post-quantum consensus test networks.
- The foundation is backing new cryptography with funding and outreach, launching two $1 million prizes, planning post-quantum community events and education, and stressing that blockchains must prepare early for quantum threats despite their long-term nature.
Top Stories
