Stablecoin Protocol Beanstalk Exploited for $180M

Beanstalk Farms, an Ethereum-based stablecoin protocol, was exploited for $182 million on Sunday after being flagged by PeckShield, a blockchain security firm.

The funds were then laundered using Tornado Cash, which enhances the privacy of transactions by breaking the on-chain link between the source and destination, enabling hackers to mask their addresses while withdrawing illegally obtained funds.

Peckshield said the attacker made out with at least $80 million in crypto coming in the form of 79,238,241 BEAN3CRV-f, 1,637,956 BEANLUSD-f, 36,084,584 BEAN, and 0.54 UNI-V2_WETH_BEAN. 

In addition, Peckshield mentioned that the attacker donated 250k USDC to a Ukrainian relief wallet. 

The market for BEAN, Beanstalk’s stablecoin, collapsed as a result of the attack. At the time of writing, the token was down 75% from its $1 peg according to CoinGecko. It currently sits at $0.25.

Beanstalk then took to their own Twitter to acknowledge the attack and mentioned that they would provide further details at a later time. 

They also said they are willing to work with anyone that can help them through this process including security firms that can prevent attacks in the future.  

According to a post on their discord, the attacker took out a flash loan on lending platform Aave, which was used to obtain a large amount of Stalk, Beanstalk’s native governance token. The attacker then passed a heinous governance that drained all protocol funds into a private Ethereum wallet. 

Beanstalk’s smart contracts were audited by the blockchain security firm Omnicia. In their post-mortem the firm made it clear that the code exploited in the attack had not been audited by them, as it was introduced beyond their initial audits of the system. However, they did detail the sequence that led to the completion of the attack. 

This is the latest attack in a series of major decentralized finance exploits to occur in the past few weeks. In March, Axie Infinity’s Ronin Blockchain was exploited for $600 million plus in an attack that U.S. officials have linked to North Korea.

Author: Tyler Irvin

Related Articles