Nirvana Finance, a Solana-based yield protocol, suffered a $3.5 million exploit utilizing flash loans to manipulate and drain its liquidity pools, blockchain data shows.
The price of the protocol’s native ANA token fell over 80% in the past few hours, while its NIRV stablecoin lost its peg to the U.S. dollar and dropped to 8 cents at writing time, CoinGecko data shows.
Nirvana allowed users to earn annual yields of over 100% on their locked assets by creating and destroying tokens based on user demand as the ANA tokens were bought from and sold to the protocol. Over $3.5 million worth of ANA was locked on the protocol before the attack on Thursday.
The loans allow traders to borrow unsecured funds from lenders using smart contracts instead of third parties. They do not require any collateral because the contract considers the transaction complete only when the borrower repays the lender. This means a borrower defaulting on a flash loan would cause the smart contract to cancel the transaction and the money would be returned to the lender.
Data from blockchain explorers shows the attack used over 10 million USDC sourced from lending tool Solend in a flash loan. At that point over $10 million worth of ANA was minted, or created, and the entire amount swapped to receive $3.5 million worth of tether (USDT) from Nirvana’s treasury wallet.
This was possible because the treasury considered the 10 million USDC infusion to be genuine. However, it wasn't, and the protocol was hence tricked into releasing its treasury's liquidity.
The 10 million USDC was returned to Solend after the exploit. The stolen funds were transferred to the Ethereum network using Wormhole, a blockchain tool that connects Solana to other networks, and converted to DAI, an Ethereum-based stablecoin, blockchain data shows.
The attacker address – 0xB9AE2624Ab08661F010185d72Dd506E199E67C09 – currently holds over $3.5 million worth of DAI, blockchain data shows.
Nirvana’s trading functions were suspended by developers following the attack, as per messages by admins on the protocol’s Telegram channel.
Nirvana had not responded to requests for comments by publication time.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is an award-winning media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. In November 2023, CoinDesk was acquired by Bullish group, owner of Bullish, a regulated, institutional digital assets exchange. Bullish group is majority owned by Block.one; both groups have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary, and an editorial committee, chaired by a former editor-in-chief of The Wall Street Journal, is being formed to support journalistic integrity.