Harvest Finance: $24M Attack Triggers $570M 'Bank Run' in Latest DeFi Exploit

Harvest Finance has seen its total value locked drop by more than $500 million in the 12 hours since being hit by a flash loan attack.

Oct 26, 2020 at 5:05 p.m. UTC
Updated Sep 14, 2021 at 10:23 a.m. UTC

An arbitrage trade exploiting weak points in decentralized finance (DeFi) protocol Harvest Finance led to some $24 million in stablecoins being siphoned away from the project’s pools on Monday, according to CoinGecko.

According to reports, an attacker used a flash loan – a technique that allows a trader to take on massive leverage without any downside – to manipulate DeFi prices for profit. The exploit sent the platform’s native token, FARM, tumbling by 65% in less than an hour, followed by the project's total value locked (TVL), which dropped from over $1 billion before the exploit to $430 million as of press time.

POOR HARVEST: The total value locked (TVL) in Harvest Finance has dropped by more than half in the 12 hours since the exploit.

The funds were eventually swapped for bitcoin (BTC), but not before being swept through Ethereum mixing service Tornado Cash.

Mixing the coins didn’t keep the Harvest Finance team in the dark for long. The person behind the exploit “is well-known in the crypto community” after leaving “a significant amount of personally identifiable information,” according to the project’s Discord. All seven bitcoin wallets holding the attacker’s funds are also known. 

The anonymous developers behind the project do not want to doxx the party but are instead offering a $100,000 bounty for convincing the attacker to send back the funds.

“For the attacker: you've proven your point, if you can return the funds to the users, it would be greatly appreciated by the community, including many bystanders,” the team said via Discord.

Flash loans strike again

The exploit itself was executed by a series of arbitrage trades between DeFi protocols Uniswap, Curve Finance and Harvest Finance, according to Etherscan. The attacker began by taking out a $50 million USDC flash loan from Uniswap. Then they began swapping between USDC and tether (USDT) to cause the two tokens’ prices to swing wildly.

The price of USDT began to drop on Harvest Finance as the attacker swapped tokens back and forth. The attacker then swapped discounted USDT for stablecoins taken out in the flash loan. The attacker performed the act multiple times. Each successful swap was then turned into ether (ETH) then tokenized bitcoin (WBTC and renBTC, in that order) and then finally BTC, according to Zerion.

Interestingly, some $2.5 million was sent back to the Harvest Finance contract. The developer team said the funds would be distributed pro rata to affected users. The token’s price has slightly rebounded, down 49% in 24 hours to $126.82, according to CoinGecko.

The exploit joins a grouping of similar flash loan–based arbitrage trades conducted against DeFi applications in 2020. For example, lending platform bZx was the first to be hit by a flash loan exploit in February 2020. 

DISCLOSURE

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.