{"id":174653,"date":"2020-10-26T13:30:23","date_gmt":"2020-10-26T13:30:23","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=174653"},"modified":"2020-10-26T23:44:43","modified_gmt":"2020-10-26T23:44:43","slug":"the-anatomy-of-a-25m-defi-hack-on-ethereum","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/the-anatomy-of-a-25m-defi-hack-on-ethereum\/","title":{"rendered":"The anatomy of a $25m DeFi exploit on Ethereum"},"content":{"rendered":"

The decentralized finance (DeFi) space has once again come under the spotlight after another hack or exploit took place. This time, approximately $25 million worth of Ethereum-based stablecoins were stolen.<\/p>\n

While this is not the largest hack<\/a> in crypto history, this has already been branded as notable as the project that was exploited was Harvest Finance. The yield-earning platform had garnered much attention over recent weeks after a number of notable DeFi investors began to mention and use the platform. Some branded it a “Yearn.finance” competitor<\/a>, comparing the two platforms to some extent.<\/p>\n

How $25m worth of Ethereum-based stablecoins were stolen from Harvest<\/h2>\n

Late on the evening of Oct. 25, Ethereum users began to notice large transactions taking place on-chain that involved a number of crucial DeFi applications: Uniswap<\/a>, Curve<\/a>, and Harvest Finance.<\/p>\n

With the sheer number of these transactions taking place, it became clear that something was amok.<\/p>\n

Analysts quickly highlighted that the attacker was likely completing some sort of arbitrage attack, where they utilized flash loans to systematically drain funds from Harvest due to inefficiencies between protocols.<\/p>\n

A flash loan is a DeFi-native concept where a user can borrow a massive amount of capital (often stablecoins) in a single transaction without putting up collateral, then ensure they return the funds (plus an additional fee) at the end of that transaction.<\/p>\n

One suspicious transaction is highlighted in the image below:<\/p>\n

\"\"<\/p>\n

In all, $25 million worth of stablecoins were stolen from the Harvest Finance pools through multiple of these transactions. The stablecoins have since been converted to RenBTC, which in turn were redeemed for BTC. The attacker's Bitcoin wallet has yet to be identified.<\/p>\n

$2.5 million was returned to the Harvest Finance admin for an unknown reason. The latter sum will be returned to users on a pro-rata basis.<\/p>\n

There is some fallout in the DeFi space online. There were some rooting for Harvest because they were the first fully anonymous DeFi team to have built a DeFi application at that scale. There are some that are bashing the concepts of anonymous teams, though, arguing it is likely that this was an inside job.<\/p>\n

There are also some unexpected winners from this.<\/p>\n

Analysts shared information online indicating that because this hack involved Curve and Uniswap, those that were providing liquidity to the pools profited handsomely from the exploit, even if they didn't endorse what was going on.<\/p>\n

Uniswap liquidity providers made around $6,000,000 while Curve liquidity providers made $1,000,000, it has been estimated.<\/p>\n

\n

pic.twitter.com\/h3VKEf5p8M<\/a><\/p>\n

— jiecut (@jiecut42) October 26, 2020<\/a><\/p><\/blockquote>\n