- Hundred Finance falls victim to $7.4 million flash loan attack on Optimism.
- Attacker manipulated ERC-20 and hTOKEN exchange rates for illicit gains.
- Security firm CertiK identifies the donation of WBTC as attack method.
Hundred Finance, a prominent multichain lending protocol, recently reported a major security breach on the Ethereum layer-2 blockchain, Optimism. The attack, resulting in a staggering $7.4 million loss, highlights emerging vulnerabilities in the decentralized finance (DeFi) sector.
The protocol first revealed the exploit on April 15, acknowledging that it had reached out to the attacker and engaged several security teams to investigate the incident. While the exact details of the attack remain undisclosed, blockchain security firm CertiK believes it was a flash loan attack.
Flash loan attacks are a growing concern in the DeFi space. In these attacks, hackers borrow substantial sums of money in the form of uncollateralized loans from lending protocols. They then exploit these funds to manipulate asset prices on DeFi platforms.
CertiK’s analysis of the Hundred Finance attack suggests that the perpetrator distorted the exchange rate between ERC-20 tokens and hTOKENS. This allowed the attacker to withdraw more tokens than they initially deposited. The manipulation centered on the cash value, which refers to the amount of Wrapped Bitcoin (WBTC) held by the hBTC contract.
The attacker reportedly donated massive quantities of WBTC to the hToken contract, causing the exchange rate to skyrocket. Under this manipulated exchange rate, the hacker proceeded to take out large loans. Hundred Finance is currently compiling a report to shed more light on this security breach.
In other news, in a court lawsuit involving the Algorand Foundation and Three Arrows Capital, the Singapore High Court ruled against recognizing cryptocurrency as money. The issue revolved around the Algorand Foundation’s application to dissolve Three Arrows Capital, which was challenged by the latter because the claim of $53.5 million USDC, was not receivable in Singapore dollars.
