Agave

Hundred Finance

Euler

Optimism

Mango

<p>Hundred Finance, a popular decentralized finance (DeFi) platform, has fallen victim to a cyberattack on the Optimism network, resulting in a loss of $7.4 million. The incident has sent shockwaves through the crypto community, raising concerns about the security of DeFi protocols.</p>



<p>According to sources, the hack occurred on April 15, 2023, when attackers exploited a vulnerability in the Optimism network, a layer 2 scaling solution for Ethereum, which Hundred Finance uses for faster and cheaper transactions.&nbsp;</p>



<h2 id="hackers-move-on-to-another-crypto-entity">Hackers move on to another crypto entity</h2>



<p>According to reports, Hundred Finance disclosed the vulnerability on April 15, stating that it had contacted the hacker and was coordinating with multiple security teams to address the incident. Although the protocol did not reveal how the attack was carried out, blockchain security firm CertiK stated that it was a flash loan attack.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/CertiKSkynetAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#CertiKSkynetAlert</a> 🚨<a href="https://twitter.com/HundredFinance?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@HundredFinance</a>’s attacker manipulated the exchange rate between ERC-20 tokens and htokens which allowed them to withdraw more tokens than they had originally deposited. The estimated losses of this attack is around $7.4 million. <br><br>Stay vigilant! <a href="https://t.co/1hxAnFoNjj" rel="nofollow" target="_blank">https://t.co/1hxAnFoNjj</a></p>&mdash; CertiK Alert (@CertiKAlert) <a href="https://twitter.com/CertiKAlert/status/1647330607565885441?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 15, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Hundred Finance is a multi-chain lending protocol that employs the veHND model for decentralized finance (DeFi). The protocol integrates with Chainlink&#8217;s oracles to ensure market health and stability.</p>



<p>Flash loan attacks involve a hacker borrowing a large sum of money from a lending protocol in the form of an unsecured loan. The hacker then manipulates the price of an asset on a decentralized finance (DeFi) platform using the stolen funds.&nbsp;</p>



<p>According to Certik, the attacker manipulated the exchange rate between ERC-20 tokens and hTOKENS in Hundred&#8217;s case, allowing them to withdraw more tokens than they had initially deposited.&nbsp;</p>



<p>On Hundred Finance&#8217;s website, hTOKENS are described as &#8220;interest-bearing, tokenized representations of user deposits&#8221; whose value fluctuates based on the activities of other borrowers. Additionally, wrapped Bitcoin, an Ethereum-based token backed 1:1 by Bitcoin, was utilized in the attack. The blockchain security company went on:</p>



<blockquote class="wp-block-quote"><p>The exchange rate formula was manipulated through Cash value. Cash is the amount of WBTC that the hBTC contract has. The attacker manipulated it by donating large amounts of WBTC to the hToken contract so that the exchange rate goes up.</p><cite>Certik</cite></blockquote>



<p>Certik claims that large loans were taken out while the exchange rate was manipulated. Hundred Finance was putting together a post-mortem report on the incident.</p>



<h2 id="hundred-finance-s-response">Hundred Finance’s response</h2>



<p>Hours after the attack, the protocol team at Hundred Finance stated that it was preparing a post-mortem to determine how the attack occurred. In addition, the protocol instructed individuals not to speculate until an official statement provides clarification.</p>



<p>Additionally, Hundred Finance stated that it is attempting to communicate with the hacker in an effort to recover some or all of the stolen funds. Hundred Finance stated in a separate Tweet that it was also communicating with various security teams about the incident.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">We advise not to speculate on how the attack was executed, team is preparing a post mortem. <br><br>Main focus is establish coms with hacker, reach an agreement. <br><br>In parallel we are gathering all information available in order to have that handy for possible further steps. <br><br>Thank you</p>&mdash; Hundred Finance (@HundredFinance) <a href="https://twitter.com/HundredFinance/status/1647465798665945088?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 16, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>A member of the Hundred Finance team with the alias acidbird stated in a chatroom on the company&#8217;s <a href="https://discord.com/channels/756024964448256011/756024964448256014/1097035989505019935" rel="nofollow noopener" target="_blank">Discord server</a> that the &#8220;hacker is not talking yet&#8221; but that the team is working &#8220;on all possible scenarios.&#8221;</p>



<p>Moreover, according to acidbird, members of the Hundred Finance team have been &#8220;hit financially&#8221; by the attack, including one individual who had all of their stablecoins on the protocol.</p>



<p>On Sunday, the protocol requested that affected users based in the United States, specifically the state of New York, contact Hundred Finance via Twitter or the messaging application Discord.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">It looks that Hundred got hacked on <a href="https://twitter.com/hashtag/Optimism?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Optimism</a>. We will update when there is more information to it.</p>&mdash; Hundred Finance (@HundredFinance) <a href="https://twitter.com/HundredFinance/status/1647247792589471745?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 15, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Saturday, when the value of the protocol&#8217;s Hundred Finance token, HND, was approximately $0.0416, according to CoinGecko, Hundred Finance issued its first Twitter alert about the attack. Since then, it has dropped approximately 46% to $0.0212.</p>



<p>According to Web-3-focused security firm Numen Cyber Technology, Hundred Finance&#8217;s loss includes over 1000 Ethereum, approximately 1.2 million stablecoin USDC, approximately 1.1 million stablecoin Tethern, and nearly 843,000 stablecoin DAI, among other tokens.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Latest Update:<br><br>The total amount exploited in the <a href="https://twitter.com/HundredFinance?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@HundredFinance</a> project on <a href="https://twitter.com/hashtag/Optimism?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Optimism</a> has been estimated to be around US$7mil<br><br>Root cause &amp; detailed attack analysis👇 <a href="https://t.co/0tJVYcwRc9" rel="nofollow" target="_blank">https://t.co/0tJVYcwRc9</a></p>&mdash; NumenAlert Ⓝ (@NumenAlert) <a href="https://twitter.com/NumenAlert/status/1647531592162873345?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 16, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>This attack comes nearly a year after Hundred was exposed to another Gnosis Chain exploit. At the time, the hacker used a reentrancy attack to drain all of the protocol&#8217;s liquidity, stealing over $6 million. The hacker also stole funds from the Agave protocol using the same exploit.</p>



<p>Several perpetrators have used flash loan attacks to target DeFi protocols since last year. Attacks on Euler Finance ($196 million) and Mango Markets ($46 million) are recent examples. While Eulerwhile&#8217;s hacker returned most of the funds, Mango&#8217;s thief was apprehended by US authorities.</p>

Hundred Finance hacked on Optimism and lost $7.4 million

Tabla de contenidos

Cryptopolitan_News

Otros artículos publicados el 17 abr 2023

SHIB, 1INCH, TWT and FXS No Longer Confined in Binance Innovation Zone

Series B Round: Why Does It Matter for KubeCoin?

Q1 2023 Global Web3 Security Report

Alphabet Down 3% in Premarket After Reports of Samsung Ditching Google for Bing

Nigerian app drivers’ union threatens million-man protest over Bolt and Uber’s plot to have their...

Securities and Commodities Authority activates applications for legacy virtual asset operators

¡Únete a nuestro boletín gratuito para recibir actualizaciones diarias de criptografía!