Ola Finance Exploited for $3.6M in Re-Entrancy Attack

The attack targeted Fuse Lending, which is an implementation of Ola Finance on the EVM-compatible Fuse blockchain.

AccessTimeIconMar 31, 2022 at 3:56 p.m. UTC
Updated Apr 10, 2024 at 2:29 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

Ola Finance disclosed Thursday that it has suffered an exploit that allowed an attacker to grab $3.6 million worth of crypto. The attack targeted Fuse Lending, which attempted to use Ola’s lending-as-a-service protocol with incompatible token standards.

According to PeckShield, a blockchain security firm that worked with Ola to diagnose the exploit, the attacker took advantage of a so-called “re-entrancy” bug in one of Ola’s smart contracts.

The attack comes after this week’s disclosure of a $625 million exploit of Axie Infinity’s Ronin network – one of the largest in decentralized finance (DeFi) history. While much smaller in comparison, the Ola attack stands as a reminder of how multimillion-dollar thefts – now commonplace in DeFi – continue to pile up as big money flows into lesser-known ecosystems.

Ola’s DeFi protocol operates across several blockchains, and Thursday’s attack targeted its deployment on the Fuse network – an Ethereum Virtual Machine-compatible blockchain with a mere $12.8 million in total value locked (TVL) prior to the attack, according to data compiled by DefiLlama.

The attacker began by withdrawing funds using Tornado Cash, which enables users to transfer crypto without leaving a trace. After transferring the funds to the Fuse network, the borrower used them as collateral to take out loans on Ola’s decentralized lending platform. Taking advantage of the re-entrancy bug, the attacker was then able to remove the collateral without first paying back the loan.

The hacker repeated this process several times across different Ola pools. They then transferred the drained funds to wallets on Ethereum and BNB Chain.

Ola has paused the use of its lending protocol on Fuse network and tweeted that it will soon publish an “official report detailing the exploit.” The project says its services on other blockchains were unaffected by the exploit and will remain operational.

This is not the first, nor the largest re-entrancy attack in recent memory.

Little more than two weeks before the Ola attack, two lending protocols on the Gnosis blockchain suffered similar exploits. The DAO attack in 2016, an infamous exploit that led to an Ethereum hard fork, was also a version of a re-entrancy attack.

UPDATE (April 2, 0:41 UTC): Adds information to clarify the relationship between Fuse Lending and Ola Finance.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Sam Kessler

Sam is CoinDesk's deputy managing editor for tech and protocols. He reports on decentralized technology, infrastructure and governance. He owns ETH and BTC.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.

Read more about