Although decentralized platforms bring many benefits to blockchain users, the security of funds on the platforms remains questionable.
Another DeFi protocol has become a victim of hacking. According to security researcher Vahe Karapetyan, the estimated loss of GrimFinance totals $40 million and was made with a similar vulnerability as that tied to flash loans and liquidity.
hack sequence
First, the hacker got a flash loan for two tokens and added liquidity to SpiritSwap, which allowed him to issue SPIRIT liquidity rewards and make a deposit call.
Then the sequence of various commands allowed the hacker to gain control over a large amount of flash loaned tokens. With the usage of the Spirit LP token, the hacker was able to make a re-deposit, which allowed him to stack a large number of additional tokens.
Currently, the transactions page has over 40 transactions made during the hack sequence. The estimated loss was counted by adding up all transactions including Bitcoin and the wrapped Fantom tokens.
The aforementioned funds have not yet been transferred to any exchange or address. With the majority of funds remaining on only one address, centralized exchanges would be able to limit the hacker’s wallet similar to the Poly.Network case.
DeFi hack series
Grim.Finance is not the first case of fund theft in the market. Previously, the Vee.Finance contract was hacked by an anonymous individual who stole $ 35 million in various cryptocurrencies.
While both cases could be considered quite significant, they cannot compete with the Poly Network hack that yielded $600 million. The stolen funds were returned, which raised numerous concerns in the DeFi community that the whole situation was a publicity stunt.
Just a month ago, the decentralized cross-chain platform supported by Alameda Research ChainSwap has also become a victim of blockchain hackers, with over 10 tokens affected by the hack. About $ 8 million in tokens have been stolen from users.
