Ola Finance disclosed Thursday that it has suffered an exploit that allowed an attacker to grab $3.6 million worth of crypto. The attack targeted Fuse Lending, which attempted to use Ola’s lending-as-a-service protocol with incompatible token standards.
According to PeckShield, a blockchain security firm that worked with Ola to diagnose the exploit, the attacker took advantage of a so-called “re-entrancy” bug in one of Ola’s smart contracts.
The attack comes after this week’s disclosure of a $625 million exploit of Axie Infinity’s Ronin network – one of the largest in decentralized finance (DeFi) history. While much smaller in comparison, the Ola attack stands as a reminder of how multimillion-dollar thefts – now commonplace in DeFi – continue to pile up as big money flows into lesser-known ecosystems.
The attacker began by withdrawing funds using Tornado Cash, which enables users to transfer crypto without leaving a trace. After transferring the funds to the Fuse network, the borrower used them as collateral to take out loans on Ola’s decentralized lending platform. Taking advantage of the re-entrancy bug, the attacker was then able to remove the collateral without first paying back the loan.
Ola has paused the use of its lending protocol on Fuse network and tweeted that it will soon publish an “official report detailing the exploit.” The project says its services on other blockchains were unaffected by the exploit and will remain operational.
This is not the first, nor the largest re-entrancy attack in recent memory.
UPDATE (April 2, 0:41 UTC): Adds information to clarify the relationship between Fuse Lending and Ola Finance.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.