DeFi protocol Beanstalk Farms lost over $180 million to malicious players due to an April 17 exploit that allowed a hacker to pass a governance proposal.

That ether-based stablecoin protocol exploit missed several tokens and saw its stablecoin pegged to the US dollar fall below the $1 mark.

Beans protocol exploited

Blockchain security company PeckShield first reported the hack on Twitter and said a Hackers have stolen more than $80 million by exploiting Beanstalk Farms.

The hacker used flash loans to obtain a large amount of Beanstalk STALK tokens, which gave them enough voting power to pass a governance proposal that drained all of the protocol’s funds into the hacker’s wallet.

The hacker then repaid the lightning loans aave, Uniswap V2 and sushi exchange and converted the funds into Wrapped ETH. The stolen funds were then sent through the Tornado Cash Mixer. The hacker also donated part of his stolen cryptos to Ukraine.

Flash loan exploits are common

The Beanstalk Farms exploit is not tThe first attackers exploited flash loans. According to the attack summary posted on Beanstalk’s Discord server, the exploit happened because Beanstalk couldn’t:

“Use a flash-loan-resistant measure to determine the percentage of Stalk who voted for GDP.”

Omnicia, the blockchain security firm responsible for testing Beanstalk smart contracts, said Beanstalk introduced the code with the flash loan vulnerability after its testing. It added in a Postmortem Analysis of the attack that the exploited code has not yet been checked.

Given the prevalence of Flash loan uses In the DeFi space, it is surprising that Beanstalk launched the code without proper verification.

Additionally, there are concerns over whether the protocol will reimburse users. Beanstalk Farms said it will provide more updates at its next town hall meeting.

The hack comes just weeks after a Ronin Bridge exploit lost over $600 million for Axie Infinity in March.

Meanwhile, hackers’ use of Tornado Cash has drawn criticism for a lack of fraud prevention efforts. TThe ETH mixer recently said that it uses the Chainanalysis Oracle contract to do this block Block addresses sanctioned by the Office of Foreign Assets Control (OFAC) from using its services.

Posted in: Ethereum, Hacks

What's your reaction?
Leave a Comment