Reentrancy, price oracle attacks and exploits across seven protocols caused the decentralized finance (DeFi) space to bleed at least $21 million in crypto in February.
According to DeFi data analytics platform DefiLlama, one of the largest in the month was the flash loan reentrancy attack on Platypus Finance, which led to $8.5 million of funds lost.
DefiLlama highlighted six other noteworthy hacks in the month, the first being the price oracle attack on BonqDAO on Feb 1.
DeFi platforms suffered seven attacks throughout February. Source: DefiLlama
BonqDAO: $1.7 million
BonqDAO revealed to its followers in a Feb. 1 post that its Bonq protocol was exposed to an oracle attack that allowed the exploiter to manipulate the price of the AllianceBlock (ALBT) token.
The exploiter increased the ALBT price and minted large amounts of Bonq Euro (BEUR). The BEUR was then swapped for other tokens on Uniswap. Then, the price decreased to almost zero, which triggered the liquidation of ALBT.
Blockchain security firm PeckShield estimated the losses to be around $120 million; however, it was later revealed hackers reportedly only cashed out around $1 million due to a lack of liquidity on BonqDAO.
Orion Protocol: $3 million
Just a day later, on Feb. 2, decentralized exchange Orion Protocol suffered a loss of roughly $3 million through a reentrancy attack, where attackers used a malicious smart contract to drain funds from a target with repeated withdrawal orders.
Orion Protocol CEO Alexey Koloskov confirmed the attack at the time, assuring everyone that “All users’ funds are safe and secure.“
"We have reasons to believe that the issue was not a result of any shortcomings in our core protocol code, but rather might have been caused by a vulnerability in mixing third-party libraries in one of the smart contracts used by our experimental and private brokers," he said.
dForce network: $3.65 million
DeFi protocol dForce network was another February victim of a reentrancy attack resulting in losses of around $3.65 million.
In a Feb. 10 post, dForce confirmed the exploit; however in a twist, all funds were returned when the hacker came forward as a whitehat hacker.
“On Feb. 13, 2023, the exploited funds were fully returned to our multi-sig on both Arbitrum and Optimism, a perfect ending for all,” dForce said.
Platypus finance: $9.1 million
On Feb. 16, DeFi protocol Platypus Finance suffered a flash loan attack resulting in $8.5 million being drained from the protocol.
A post-mortem report from Platypus auditor Omniscia noted that the attack was possible because of code in the wrong order.
On Feb. 23, the team announced that they are seeking to return around 78% of the main pool funds by reminting frozen stablecoins.
The team also confirmed second and third incidents, which led to another $667,000 exploited, bringing total losses to around $9.1 million.
French police arrested two suspects related to the hack and seized around $222,000 worth of crypto assets on Feb. 25.
Hope finance: $1.86 million
A few days later, users of arbitrum-based algorithmic stablecoin project, Hope Finance, fell prey to a smart contract exploit on Feb. 20, which saw roughly $2 million stolen from users.
Web3 security firm CertiK flagged the incident on Feb. 21, following an announcement from the Hope Finance Twitter account notifying users of the scam.
A member of the CertiK team told Cointelegraph at the time that the scammer had changed the details of the smart contract, which led to funds being drained from Hope Finance genesis protocol:
It appears that the scammer changed the TradingHelper contract which meant that when 0x4481 calls OpenTrade on the GenesisRewardPool the funds are transferred to the scammer.
Dexible: $2 million
Multichain exchange aggregator Dexible was hit by an exploit that targeted the app’s selfSwap function, with $2 million worth of cryptocurrency lost as a result of the Feb. 17 attack.
According to a Feb. 18 post from the exchange, “a hacker exploited a vulnerability in our newest smart contract. This allowed the hacker to steal funds from any wallet that had an unspent spend approval on the contract.”
After investigating, the Dexible team found the attacker had used the app’s selfSwap function to move over $2 million worth of crypto from users that had previously authorized the app to move their tokens.
After receiving the tokens into their own smart contract, the attacker withdrew the coins through Tornado Cash into unknown BNB wallets.
LaunchZone: $700,000
BNB Chain-based DeFi protocol LaunchZone had $700,000 worth of funds drained on Feb. 27.
According to blockchain security firm Immunefi, an attacker leveraged an unverified contract to drain the funds.
"An approval had been made to the unverified contract 473 days ago by the LaunchZone deployer," Immunefi said.
The February figures are a stark increase from January, according to DefiLlama figures.
The tracker lists only $740,000 in hacks to DeFi platforms in the month across two protocols — Midas Capital and ROE Finance.
In its 2023 Crypto Crime Report, blockchain data firm Chainalysis revealed that hackers stole $3.1 billion from DeFi protocols in 2022, accounting for more than 82% of the total amount stolen in the year.
Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers.
Recommended Content
Editors’ Picks
Bitcoin Weekly Forecast: BTC nosedives below $95,000 as spot ETFs record highest daily outflow since launch
Bitcoin price continues to edge down, trading below $95,000 on Friday after declining more than 9% this week. Bitcoin US spot ETFs recorded the highest single-day outflow on Thursday since their launch in January.
Bitcoin crashes to $96,000, altcoins bleed: Top trades for sidelined buyers
Bitcoin (BTC) slipped under the $100,000 milestone and touched the $96,000 level briefly on Friday, a sharp decline that has also hit hard prices of other altcoins and particularly meme coins.
Solana Price Forecast: SOL’s technical outlook and on-chain metrics hint at a double-digit correction
Solana (SOL) price trades in red below $194 on Friday after declining more than 13% this week. The recent downturn has led to $38 million in total liquidations, with over $33 million coming from long positions.
SEC approves Hashdex and Franklin Templeton's combined Bitcoin and Ethereum crypto index ETFs
The SEC approved Hashdex's proposal for a crypto index ETF. The ETF currently features Bitcoin and Ethereum, with possible additions in the future. The agency also approved Franklin Templeton's amendment to its Cboe BZX for a crypto index ETF.
Bitcoin: 2025 outlook brightens on expectations of US pro-crypto policy
Bitcoin (BTC) price has surged more than 140% in 2024, reaching the $100K milestone in early December. The rally was driven by the launch of Bitcoin Spot Exchange Traded Funds (ETFs) in January and the reduced supply following the fourth halving event in April.
Best Forex Brokers with Low Spreads
VERIFIED Low spreads are crucial for reducing trading costs. Explore top Forex brokers offering competitive spreads and high leverage. Compare options for EUR/USD, GBP/USD, USD/JPY, and Gold.