Hundred Finance hacker moves stolen assets a year after $7M exploit

As an experienced analyst in the field of blockchain security and decentralized finance (DeFi), I’ve seen my fair share of hacks and exploits over the years. The recent news of a hacker moving funds stolen from Hundred Finance last year is a stark reminder of the risks that come with investing and interacting with smart contracts on the blockchain.

As a researcher studying the world of cybercrime and decentralized finance, I’ve come across an intriguing development: over a year since the infamous hack on Hundred Finance, the perpetrator has begun transferring the stolen crypto assets worth approximately $7.4 million.

Approximately $800,000 in Ether (ETH) and Tether (USDT) was taken by a hacker from Curve’s decentralized exchange (DEX) on May 1. This transfer occurred after the hacker had supplied liquidity to the platform over a year ago.

Hundred Finance hacker moves stolen assets a year after $7M exploit

As a researcher studying cybercrime trends, I’ve come across cases where hackers have managed to convert USDT and other cryptocurrencies into Ethereum (ETH) following a successful fund withdrawal. This conversion process has significantly boosted their ETH holdings by over $1 million.

Currently, the hacker possesses approximately $4.3 million worth of diverse cryptocurrencies in their digital wallet. These assets consist of Dai, Wrapped Ethereum, Frax, and Wrapped Bitcoin.

I. On the 15th of April, 2023, I came across a disconcerting announcement from the Decentralized Finance (DeFi) protocol: they had fallen victim to a security incident occurring on the Optimistic Layer-2 network.

Based on the findings of cybersecurity company CertiK, an intruder artfully tampered with the conversion rate between ERC-20 tokens and hTOKENS. Consequently, they succeeded in extracting a greater amount of tokens than initially deposited.

In the Decentralized Finance (DeFi) community, this is often referred to as a “flash loan assault.” It’s an unconventional method of obtaining substantial loans without collateral from a lending protocol.

As a crypto investor, I’ve learned that attackers can exploit Decentralized Finance (DeFi) platforms by manipulating the price of cryptocurrencies using the stolen assets. In the case of the Hundred Finance hack, for instance, they managed to take out large loans under a falsified exchange rate.

In 2022, Hundred Finance experienced a significant setback when it fell victim to a reentrancy attack on the Gnosis Chain. This attack led to the drainage of the protocol’s liquidity and resulted in a monetary loss amounting to $6 million.

As a seasoned crypto investor, I’ve witnessed the destructive impact of flash loan attacks on our community over the past few years. However, something remarkable occurred in April 2024: the frequency and magnitude of these hacks significantly lessened.

Based on CertiK’s findings from their report, the financial damage caused by flash loan attacks in April totaled approximately $129,000. The most significant incident during this period resulted in around $55,000 worth of damages. Notably, this represents the smallest amount of losses due to flash loan attacks since February 2022.

During the month of April, crypto hack-related losses saw a significant decrease. According to PeckShield’s report, a mere $60 million was stolen through hacks during this period. This is a substantial reduction when compared to the losses seen in February and March, which amounted to $360 million and $187 million respectively.

2024-05-02 14:17

Read More