Credit-based stablecoin protocol Beanstalk Farms has suffered a security breach, which resulted in the company loosing all of its $182 million collateral in a flash loan attack.
Beanstalk Farms is a decentralized finance (DeFi) project aimed at balancing the supply and demand of different cryptocurrency assets.
The attack spotted over the weekend by blockchain analytics company PeckShield abused Beanstalk’s majority vote governance system, a core feature of many DeFi protocols. It is estimated that the net profit for the attacker was nearly $80 million of the total funds stolen. A portion of the stolen assets was used to pay the flash loan fee.
“On the 17th of April 2022, the Beanstalk Protocol experienced a flash-loan attack due to a flaw in its newly introduced Curve LP Silos that compromised the protocol’s governance mechanism, ultimately permitting the attacker to conduct an emergency execution of a malicious proposal siphoning project funds,” Beanstalk explained in a blog post.
Flash loans allow users to borrow any available amount of assets without putting up any collateral.
The Beanstalk attack took advantage of the lack of an anti-flashloan mechanism in the Beanstalk protocol. The hacker used a flash loan obtained through the decentralized protocol Aave to gain sufficient voting power in the project, which allowed them to approve the execution of code that transferred the cryptocurrency assets to their own wallet. According to PeckShield, the attacker laundered a portion of funds using coin-mixing platform Tornado Cash.
The researchers also noted that the hacker donated $250,000 to Ukraine, which has been accepting cryptocurrency donations since the start of Russia’s invasion in February.
Cybersecurity Help statement on the critical situation in Ukraine
On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war! Слава Україні!