DeFi Exploits in 2021 have already crossed the figures recorded in 2020. With the amount of money locked on DeFi protocols is increasing by many folds, criminals are also attacking them to get away with the bunch of money.
While fewer DeFi attacks have occurred in 2021, they are more devastating than the hacks that happened in 2020. According to a CipherTrace report, by the end of April 2021, criminals were able to net $156 million in the first five months of 2021. This amount has surpassed the $129 million stolen in DeFi-related hacks throughout all of 2020.
Let’s explore the DeFi exploits that have happened so far in 2021.
DeFi Hacks and Exploits in Q1
February 4: Yearn Finance (YFI) Flash Loan Attack
January 2021 was uneventful and the crypto and DeFi market were enjoying a boom. In February, Yearn Finance, a lending aggregation protocol and currently the 8th largest Ethereum-based DeFi platform by TVL of $3.26 billion, was the first victim of criminals in 2021 who want to benefit from this emerging market by their own methods.
On February 4, 2021, Yearn Finance suffered an exploit funded by flash loans. According to the details, Yearn Finance’s yDAI wallet vault was exploited for the loss of $11 million. Though the attacker robbed Yearn of $11 million, he was able only to profit $2.7 million in DAI as excessive fees cost him millions to execute the hack.
We have noticed the v1 yDAI vault has suffered an exploit. The exploit has been mitigated. Full report to follow.
— yearn (@yearnfi) February 4, 2021
The attacker initiated the attack with flash loans borrowed from dYdX and Aave. He then used these loans as collateral for another loan on Compound. After that, the attackers deposited these funds in the yDAI vault, inflating the price of DAI. Finally, He swapped his Curve tokens, which were accumulated from a pool with their inflated DAI.
The attack was mitigated. The team responded within 11 minutes and the team was able to protect the remaining $24 million stored in the vault from the attacker. After the exploit, Yearn Finance conducted a series of audits through MixBytes.
February 13: Alpha Homora Flash Loan Attack
On February 13, Alpha Homora V2, a yield leveraging DeFi protocol on Ethereum, was exploited for over $37 million in a complicated flash loan attack on Homora’s Iron Bank.
Dear Alpha community, we've been notified of an exploit on Alpha Homora V2. We're now working with @AndreCronjeTech and @CreamdotFinance together on this.
The loophole has been patched.
We're in the process of investigating the stolen fund, and have a prime suspect already.
— Stella💫️️ | 0% Cost Leveraged Strategies Protocol (@stellaxyz_) February 13, 2021
After the attack, Alpha Homora released a post mortem report. According to the report, the attacker was able to use Alpha’s sUSD contracts that were not released to the public at that time. Cream Finance’s V2 Iron Bank was also affected in the hack as Alpha Homora V2 was integrated with Cream V2 in a protocol-to-protocol lending way.
The attack was a complicated one and involved 9 transactions. According to the details, the attacker used Alpha Homora multiple times for borrowing sUSD from Iron Bank. Each time they borrow twice as much as in the previous one. Each time the attacker lent these funds to Cream Finance’s Iron Bank, receiving cySUSD. The perpetrators did this multiple times: borrowing sUSD from Alpha Homora, lending these funds to Cream’s Iron Bank, and receiving cySUSD.
After completing multiple transactions, the attacker had accumulated a large hoard of cySUSD. In the end, the number of their cySUSD reaches an incredible amount, which allows them to borrow anything from IronBank. Then he borrowed 13.2k WETH, 3.6M USDC, 5.6M USDT, and 4.2M DAI. From these borrowed funds, all three stablecoins were deposited to Aave V2. The 13.2k Ether was distributed to several different places: 1,000 ETHs to Iron Bank, 1,000 ETHs to Alpha Homora, 320 ETHs to a donation fund, and 10,925 ETHs retained in the wallet. At the end of the exploit, the Alpha Homora attacker was able to make approximately $37.5.
According to Alpha Homora, no users’ funds were lost as there was no liquidity in the sUSD lending pool.
February 27: Furucombo’s Smart Contract Exploit
On February 27, Furucombo, a protocol to batch transactions and interactions with multiple DeFi protocols at once, was exploited for $15 million. According to the post mortem report, The breach affected 22 Furucombo users’ and resulted in funds, made up of 21 different assets worth US$15million, being stolen by an unknown attacker.
This was an “evil contract” exploit in which a fake contract made Furuсombo think that Aave v2 has a new implementation. Because of this, all interactions with Aave v2 allowed transfers of approved tokens to an arbitrary address.
March 8: DODO DEX Exploit
On March 8, 2021, DODO, an Ethereum and BSC-based DEX, experienced a smart contract hack, and the attackers were able to steal approximately $3.8 million in cryptocurrency from several of DODO’s crowdfunding pools.
PSA Regarding Recent Exploit on DODO
On March 8, Several DODO V2 Crowdpools were attacked. WSZO, WCRES, ETHA, and FUSI pools were impacted, while AC pool funds have been fully recovered.
Funds in all other pools, including all V1 pools and all non-Crowdpool V2 pools, are safe.
— DODO 📜 | Cross-Chain DEX Aggregator (@BreederDodo) March 9, 2021
DODO provides liquidity to traders by miners contributing to Crowdpools. Four of these pools WSZO, WCRES, ETHA, and FUSI were affected by the exploit. The details suggest that hackers took the advantage of a bug in DODO V2 Crowdpooling smart contract. The bug was in the init() function of the contract.
The attackers first created a counterfeit token and called the init() function of the vulnerable smart contract. Using the sync() function, they set the reserved variable of the contract to 0, showing 0 token balance. The attacker calls init() again but this time pointed it to a real token from one of DODO’s pools. Then they used a flash loan to transfer all such coins from the pools and bypass the flash loan check. According to some sources, the DODO team was able to recover $3.1 million of the stolen assets.
March 4: Meerkat Fiance $31M Exploit
On March 4, 2020, just one day after launch, Meerkat Finance, a BSC-based yield farming DeFi protocol, claimed that it had been hacked for $31 million. The teal claimed that its smart contract vault was exploited and the attacker drained about 13 million BUSD and 73,000 BNB, which worthed $31 million at that time.
But the community believed that this was an exit scam and the Meerkat Finance team has run away with users’ funds as on-chain analysis revealed that funds were drained by altering Meerkat’s smart contract that contains the project’s vault business logic via using the original Meerkat deployer’s account. The suspicions of a rug pull grew when shortly after the hack, Meerkat Finance’s website and Twitter account went offline.
March 5: PAID Network Infinite Mint Attack
On March 5, PAID Network, a smart contract program for businesses that conducted the most popular Initial DEX Offerings (IDOs) on Polkastarter, was exploited for about $3 million. The attacker exploited PAID Network’s mining feature, creating 60 million PAID tokens out of nothing and transferring them to their wallet.
Given the price of the PAID token of $2.8 at that time, the attacker was able to steal $180 million. But the price plummeted nearly 90% after the attack. He swapped around $3m to Wrapped Ether (WETH), but the rest remained in PAID tokens.
The community expected another exit scam but the team responded after few days. According to the details, the attack was the result of poor key management of the smart contract, not a vulnerability. The network relied on a single private key to manage control over the smart contract. By compromising that private key, the attacker was able to gain control over the upgrade function of the contract.
The attacker upgraded and replaced the original smart contract with a malicious version that allowed tokens to be burned and minted. The project still exists and PAID token is priced at $0.422 at the time of writing.
March 15: Roll’s Hot Wallet Breach
On March 15, Roll, a social token platform on Ethereum, suffered a hot wallet breach, resulting in hackers draining at least 3,000 ETH worth $5.7 million. The attacker stole 11 different social tokens, including $WHALE, $RARE, and $PICA. According to the team, the private keys to the hot wallet were compromised.
Earlier today, the private keys to our hot wallet were compromised.
We're investigating this with our infrastructure provider, security engineers and law enforcement.
Additionally, we're putting together a $500,000 fund for creators affected by this. https://t.co/fQ2QbFgVAT pic.twitter.com/93pfyRGhi2
— Roll (@tryrollhq) March 14, 2021
DeFi Hacks in Q2
April 3: ForceDAO Launch Day Exploit
On April 3, 2021, Ethereum-based yield aggregator ForceDAO was hacked just hours after it launched. According to a post mortem report, on April 3, just after ForaceDAO launched its airdrop campaign, four black-hat hackers managed to drain a total of 183 Ether (ETH), worth approximately $367,000 at that time. A white-hat hacker assisted the ForceDAO team by alerting them to prevent further losses.
According to the details, attackers were able to exploit a bug in ForceDAO’s xFORCE vault, a fork of a SushiSwap smart contract containing a mechanism to revert tokens in the event of failed transactions. Hackers deposited FORCE tokens that they knew would fail to transfer, yet were still somehow able to receive xFORCE tokens for themselves. Then swapped these xForce tokens for ETH.
April 28: Uranium Finance $50M Hack
On April 28, Uranium Finance, an AMM platform on BSC, reported that the platform had been exploited for $50 million. The hacker was able to steal $36.8 million in Binance Coin (BNB) and Binance USD (BUSD), 80 Bitcoin, 1,800 Ether, 26,500 Polkadot, 5.7 million Tether, 638,000 Cardano (ADA), and 112,000 u92, the project’s native coin.
(1/2)‼️ Uranium migration has been exploited, the following address has 50m in it The only thing that matters is keeping the funds on BSC, everyone please start tweeting this address to Binance immediately asking them to stop transfers.
— Uranium Finance (@UraniumFinance) April 28, 2021
The exploit happened when the protocol was conducting its token migration event from V2 to V2.1. The hacker was able to exploit a coding error in the platform’s balance modifier logic. This indeed was the second attack on Uranium Finance in April. The first attack force the platform to migrate to V2 and then the team suddenly decided to another version upgrade, V 2.1. The team suspected that was this was an insider job who might have leaked the vulnerability.
https://twitter.com/BeTheb0x/status/1387288334649622528?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1387288334649622528%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcointelegraph.com%2Fnews%2F50m-reportedly-stolen-from-bsc-based-uranium-finance
April 19: EasyFi’s $80 Million Attack
On Monday, April 19th, 2021, EasyFi, a DeFi protocol based on Polygon Network, reported suffering a hack of over $80 million. Hacker was able to get away with 2.98 million EASY tokens, which were worth around $25 apiece at the time, for a total of around $75 million and $6 million worth of stablecoins including DAI and Tether (USDT).
According to a blog post by EasyFi by CEO and founder Ankitt Gaur, the private keys to the network admin MetaMask account had been compromised through his computer and nothing was wrong EasiFy contracts.
May 1: Spartan Protocol Flash Loan Attack
On May 1, Spartan Protocol, a BSC-based defi platform, was exploited for $30 million in a flash loan attack. According to a report by a security firm PeckShield, the exploit happened due to a “flawed logic in calculating the liquidity share when the pool token is burned to withdraw the underlying assets.”
The attacker first took a flash loan of 100,000 wrapped BNB (wBNB) from PancakeSwap. The attacker then swapped wBNB to the protocol’s native SPARTA token five times through the exploited Spartan pool. The process was completed a further ten times to inflate the asset balance in the pool. The hacker then used DEXs 1inch and Nerve Finance to withdraw the stolen funds.
May 8: Rari Capital‘s $11 Million Evil Contract Exploit
On May 8, Rari Capital, a DeFi platform that a series of products to earn yield, reported an $11 million exploit on its platform. According to the experts, the hack was an evil contract exploit, in which an attacker ‘tricks’ a contract into thinking a hostile contract should have access or permissions.
There has been an exploit in the Rari Capital ETH Pool related to our @AlphaFinanceLab integration.
The rebalancer has removed all funds from Alpha in response.
We are currently investigating the situation and a full report will be shared once everything is assessed.
— Rari Capital (@RariCapital) May 8, 2021
According to post mortem report, the hack was related to Rari’s interest-bearing ibETH vault. The Rari Capital Ethereum Pool deposits ETH into Alpha Finance’s ibETH token as their yield-generating strategies. The attacker exploited its yield-generating integration with Alpha Finance Labs’ ibETH token. The attacker first took an ETH flash loan from dYdX and deposited them into the Rari Capital Ethereum Pool.
He then manipulated the value of `ibETH.totalETH()` by pushing it artificially high. This way, the hacker was able to more ETH from the Rari Capital Ethereum Pool than deposited. He stole approximately 2600 ETH, around $11 million at that time.
May 20: PancakeBunny’s $200M Flash Loan Exploit
On May 20, popular BSC-based DeFi protocol PancakeBunny suffered a flash loan attack that resulted in the loss of more than $200 million worth of crypto assets. According to the team, the attacker made off with 697,000 BUNNY and 114,000 BNB, worth more than $200 million.
4⃣ The hacker then dumped all the bunny in the market, causing the bunny price to plummet
5⃣The hacker paid back the bnb through pancakeswaphttps://t.co/ph9OoLQQADhttps://t.co/IWYfBHuijb
— pancakebunny.finance (@PancakeBunnyFin) May 20, 2021
In the exploit, the hacker used PancakeSwap to borrow a huge amount of BNB and deposited them to USDT/BNB and BUNNY/BNB pool, manipulating assets balance. The hacker ended up getting a huge amount of BUNNY and BNB tokens through this flash loan attack.
1⃣ The hacker used PancakeSwap to borrow a huge amount of BNB
2⃣ The hacker then went on to manipuate the price of USDT/BNB as well as BUNNY/BNB
3⃣ The hacker ended up getting a huge amount of BUNNY through this flash loan
— pancakebunny.finance (@PancakeBunnyFin) May 20, 2021
May 22: Bogged Finance $3M Flash Loan Attack
On May 22, Bogged Finance joined the growing list of BSC-based DeFi protocols exploited in flash loan attacks. In the exploit, the hacker was able to make off 11,358 Binance Coin (BNB), worth totaling $3 million at that time.
According to a report by the Bogged Finance team:
“The attacker was able to utilize flash loans to exploit a flaw in the staking section of the BOG smart contract to manipulate the staking rewards and cause an inflation of supply — without the transaction fee being charged and burned — causing net inflation.”
May 28: BurgerSwap $7.2M Flash Loan Attack
On May 28, BurgerSwap, a decentralized exchange based on the Binance Smart Chain, reported a flash loan exploit that resulted in the loss of $7.2 million in users’ funds. The attacker made off with $1.6 million in Wrapped BNB, $6,800 in ETH, $3.2 million of BURGER coin, $1 million of xBURGER, 95,000 ROCKS ($152,000), $22,000 of BUSD, and a further $1.4 in Tether (USDT). According to details, the hacker launched a flash loan attack with the help of a fake token.
6/9
(3) Created pair with a fake token on BurgerSwap & added 100 fake tokens and 45k $BURGER to pool;
(4) Swapped 100fake tokens to 4,400 $WBNB through the pool;
(5) Because of reentrancy in time of transfer fake token, attacker did another swap from 45k $BURGER to 4.4k $WBNB; pic.twitter.com/SeVcE2bJ6w— BurgerCities (@burger_cities) May 28, 2021
May 30: Belt Finance $6.3M Flash Loan Exploit
On May 30, another BSC-based DeFi protocol, Belt Finance, a yield aggregator platform, fell victim to a flash loan attack losing $6.3 million. According to a report by Rekt, the was one most complex flash loan exploit where the hacker exploited a flaw in the way the protocol’s vaults calculate the value of its collateral.
The exploit was in the beltBUSD vault's Elipsis strategy. The vault uses multiple strategies: Elipsis, Venus, Alpaca, and Fortube. Although the exploit happened due to a bug in Elipsis strategy, funds were leaked via the Venus strategy.
— Mudit Gupta (@Mudit__Gupta) May 30, 2021
Elipsis is a decentralized exchange that enables the swapping of stablecoins with low slippage on the Binance Smart Chain. As a yield aggregator, Belt deploys capital on Elipsis as a yield-generating strategy. In the exploit, the beltBUSD vault’s Elipsis strategy was exploited.
June 16: Alchemix Reverse Rug Event
On June 16th, Alchemix, an Ethereum-based DeFi protocol, suffered a unique $6.5 million exploit in which users of the protocol were the ones to benefit. Alchemix is an innovative DeFi protocol that puts users’ collateral to work via yield farming. The interest this generates is used to pay back some or all of the loan.
There has been an incident with the Alchemix alETH contracts. Together with the fantastic team at @iearnfinance, we have identified the error and are both working on a post-mortem and a solution to the problem.
Funds are safe.
— Alchemix (@AlchemixFi) June 16, 2021
On June 16, a bug in the Alchemix alETH vault led the vault to become undercollateralized. According to the details, the bug accidentally created additional vaults, and the protocol used some of these vaults to incorrectly calculate outstanding debts, which in turn meant protocol funds were used to pay off user debts. For a short period, users were able to withdraw their ETH collateral with their alETH loans still outstanding, resulting in a reverse rug pull of around $6.53 million.
June 21: Impossible Finance $0.5M Flash Loan Exploit
On June 21, another BSC-based DeFi protocol Impossible Finance lost about 230 ETHs, approximately $500,000, in user funds during a flash loan attack. According to the reports, the exploit was similar to the BurgerSwap exploit in which the attacker launched a flash loan attack to drain Impossible Finance’s liquidity pool with the help of a fake token.
Impossible finance got exploited today for $500k.https://t.co/mzCPRluOjn
Same exploit as the burger swap one:https://t.co/3PkVtn7Hi7
If the original project gets hacked, why don't the forks react?
— Mudit Gupta (@Mudit__Gupta) June 21, 2021
Comparison: 2020 vs 2021
As DeFi space is enjoying a great time, so does the criminals. DeFi crimes were unheard of in 2019. However, in the second half of 2020, the DeFi market exploded, and new projects started to emerge every day which is still happening.
DeFi crimes also ramped up with this growth. According to a CipherTrace report in November 2020, DeFi hacks made up 25% of 2020 hack and theft volume. In total, $129 million was lost in 2020 in DeFi related crimes.
But in 2021, DeFi-related crimes’ weightage grew higher as TVL on Ethereum-based DeFi platforms was $85 billion in May, compared to $16 billion on January 1. According to CipherTrace’s May report:
“At $156 million, the amount netted from DeFi-related hacks in the first five months of 2021 already surpasses the $129 million stolen in DeFi-related hacks throughout all of 2020.”
With this, DeFi-related hacks made up more than 60% of the total hack and theft volume. This amount does not include an additional $83.4 million lost through DeFi-related frauds such as rug pull or exit scams.
Factors Leading to These Events
Flash Loan Attacks
As we can see from the above discussion, flash loan attacks account for most of the DeFi exploits. A flash loan attack is an exploit wherein a hacker takes an uncollateralized loan from a lending protocol and manipulates the market in their favor via a series of technical tricks.
Flash loans are an important innovation in DeFI as they allow small-time players to participate in the market. Unfortunately, this also makes flash loans easy and cheap to pull off. But, flash loan attacks are here to stay as there is still no solid solution to replace or defend against these attacks.
Smart Contract Bugs
Other factors include smart contract bugs and coding errors as teams rush to launch their product to share their part in this growing space. Extensive audits are conducted but even this does not ensure foolproof security.
Rug Pull or Exit Scams
Rug Pull or exit scams are also major factors in DeFi-related frauds. Most of the teams in rug pull events are anonymous developers who promise to yield farmers a ridiculously large APY. As soon as enough funds have been locked into a smart contract, the developer suddenly withdraws all the funds from the liquidity pool and disappears forever with the funds, causing the token’s price to crash to zero.
Binance Smar Chain (BSC) Hacks
Due to the scalability and high gas fees problems of DeFi king, Binance’s smart contract blockchain platform has seen a surge in demand since its launch in September 2020, due to its low fees and high throughput.
Nascent DeFi platforms running on BSC have attracted large user bases but these rushly launched DeFi platforms are also falling victims to crypto criminals. Below is the list of BSC-based DeFi protocols that were hacked or exploited in 2021 so far.
- March 4: Meerkat Fiance exploited for $31 million
- March 8: DODO DEX exploited for $3.8 million
- April 28: Uranium Finance exploited for $50 million
- May 1: Spartan Protocol exploited for $30 million
- May 20: PancakeBunny exploited for $200 million
- May 22: Bogged Finance exploited for $3 million
- May 28: BurgerSwap exploited for $7.2 million
- May 30: Belt Finance exploited for $6.3 million
- June 21: Impossible Finance exploited for $0.5 million
If you found this article interesting, here you can find more DeFi News
