Agave

Hundred Finance

Euler

Optimism

Mango

<p>Hundred Finance, a popular decentralized finance (DeFi) platform, has fallen victim to a cyberattack on the Optimism network, resulting in a loss of $7.4 million. The incident has sent shockwaves through the crypto community, raising concerns about the security of DeFi protocols.</p>



<p>According to sources, the hack occurred on April 15, 2023, when attackers exploited a vulnerability in the Optimism network, a layer 2 scaling solution for Ethereum, which Hundred Finance uses for faster and cheaper transactions.&nbsp;</p>



<h2 id="hackers-move-on-to-another-crypto-entity">Hackers move on to another crypto entity</h2>



<p>According to reports, Hundred Finance disclosed the vulnerability on April 15, stating that it had contacted the hacker and was coordinating with multiple security teams to address the incident. Although the protocol did not reveal how the attack was carried out, blockchain security firm CertiK stated that it was a flash loan attack.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/CertiKSkynetAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#CertiKSkynetAlert</a> 🚨<a href="https://twitter.com/HundredFinance?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@HundredFinance</a>’s attacker manipulated the exchange rate between ERC-20 tokens and htokens which allowed them to withdraw more tokens than they had originally deposited. The estimated losses of this attack is around $7.4 million. <br><br>Stay vigilant! <a href="https://t.co/1hxAnFoNjj" rel="nofollow" target="_blank">https://t.co/1hxAnFoNjj</a></p>&mdash; CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/1647330607565885441?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 15, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Hundred Finance is a multi-chain lending protocol that employs the veHND model for decentralized finance (DeFi). The protocol integrates with Chainlink&#8217;s oracles to ensure market health and stability.</p>



<p>Flash loan attacks involve a hacker borrowing a large sum of money from a lending protocol in the form of an unsecured loan. The hacker then manipulates the price of an asset on a decentralized finance (DeFi) platform using the stolen funds.&nbsp;</p>



<p>According to Certik, the attacker manipulated the exchange rate between ERC-20 tokens and hTOKENS in Hundred&#8217;s case, allowing them to withdraw more tokens than they had initially deposited.&nbsp;</p>



<p>On Hundred Finance&#8217;s website, hTOKENS are described as &#8220;interest-bearing, tokenized representations of user deposits&#8221; whose value fluctuates based on the activities of other borrowers. Additionally, wrapped Bitcoin, an Ethereum-based token backed 1:1 by Bitcoin, was utilized in the attack. The blockchain security company went on:</p>



<blockquote class="wp-block-quote"><p>The exchange rate formula was manipulated through Cash value. Cash is the amount of WBTC that the hBTC contract has. The attacker manipulated it by donating large amounts of WBTC to the hToken contract so that the exchange rate goes up.</p><cite>Certik</cite></blockquote>



<p>Certik claims that large loans were taken out while the exchange rate was manipulated. Hundred Finance was putting together a post-mortem report on the incident.</p>



<h2 id="hundred-finance-s-response">Hundred Finance’s response</h2>



<p>Hours after the attack, the protocol team at Hundred Finance stated that it was preparing a post-mortem to determine how the attack occurred. In addition, the protocol instructed individuals not to speculate until an official statement provides clarification.</p>



<p>Additionally, Hundred Finance stated that it is attempting to communicate with the hacker in an effort to recover some or all of the stolen funds. Hundred Finance stated in a separate Tweet that it was also communicating with various security teams about the incident.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">We advise not to speculate on how the attack was executed, team is preparing a post mortem. <br><br>Main focus is establish coms with hacker, reach an agreement. <br><br>In parallel we are gathering all information available in order to have that handy for possible further steps. <br><br>Thank you</p>&mdash; Hundred Finance (@HundredFinance) <a href="https://twitter.com/HundredFinance/status/1647465798665945088?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 16, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>A member of the Hundred Finance team with the alias acidbird stated in a chatroom on the company&#8217;s <a href="https://discord.com/channels/756024964448256011/756024964448256014/1097035989505019935" rel="nofollow noopener" target="_blank">Discord server</a> that the &#8220;hacker is not talking yet&#8221; but that the team is working &#8220;on all possible scenarios.&#8221;</p>



<p>Moreover, according to acidbird, members of the Hundred Finance team have been &#8220;hit financially&#8221; by the attack, including one individual who had all of their stablecoins on the protocol.</p>



<p>On Sunday, the protocol requested that affected users based in the United States, specifically the state of New York, contact Hundred Finance via Twitter or the messaging application Discord.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">It looks that Hundred got hacked on <a href="https://twitter.com/hashtag/Optimism?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Optimism</a>. We will update when there is more information to it.</p>&mdash; Hundred Finance (@HundredFinance) <a href="https://twitter.com/HundredFinance/status/1647247792589471745?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 15, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Saturday, when the value of the protocol&#8217;s Hundred Finance token, HND, was approximately $0.0416, according to CoinGecko, Hundred Finance issued its first Twitter alert about the attack. Since then, it has dropped approximately 46% to $0.0212.</p>



<p>According to Web-3-focused security firm Numen Cyber Technology, Hundred Finance&#8217;s loss includes over 1000 Ethereum, approximately 1.2 million stablecoin USDC, approximately 1.1 million stablecoin Tethern, and nearly 843,000 stablecoin DAI, among other tokens.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Latest Update:<br><br>The total amount exploited in the <a href="https://twitter.com/HundredFinance?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@HundredFinance</a> project on <a href="https://twitter.com/hashtag/Optimism?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Optimism</a> has been estimated to be around US$7mil<br><br>Root cause &amp; detailed attack analysis👇 <a href="https://t.co/0tJVYcwRc9" rel="nofollow" target="_blank">https://t.co/0tJVYcwRc9</a></p>&mdash; NumenAlert Ⓝ (@NumenAlert) <a href="https://twitter.com/NumenAlert/status/1647531592162873345?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 16, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>This attack comes nearly a year after Hundred was exposed to another Gnosis Chain exploit. At the time, the hacker used a reentrancy attack to drain all of the protocol&#8217;s liquidity, stealing over $6 million. The hacker also stole funds from the Agave protocol using the same exploit.</p>



<p>Several perpetrators have used flash loan attacks to target DeFi protocols since last year. Attacks on Euler Finance ($196 million) and Mango Markets ($46 million) are recent examples. While Eulerwhile&#8217;s hacker returned most of the funds, Mango&#8217;s thief was apprehended by US authorities.</p>

Hundred Finance hacked on Optimism and lost $7.4 million

Table of Contents

Cryptopolitan_News

Other articles published on Apr 17, 2023

Bhutan’s Sovereign Fund Defaulted on BlockFi Debt, According to Report

Shapella hard fork triggers 1 million ETH withdrawals; price reaches 11-month high

Securities and Commodities Authority Activates Applications for Legacy Virtual Asset Operators

Save Easter and Get a Share of the 600 mBTC Prize Pool

How Much ETH Do You Need To Be a Millionaire By 2030?

TMS Network (TMSN) Takes the Crypto World by Storm, Surpassing Mask Network (MASK) and Tron (TRX)...

Join our free newsletter for daily crypto updates!