DeFi provides ways and tools to benefit from decentralized lending and borrowing, but given that the field as a whole is emerging, it contains many loopholes and risks.

Recently, a hack was revealed that affected the decentralized finance project “Harvest Finance”, which resulted in the loss of $24 million.

Economic Exploitation of Harvest Finance Project:

Harvest Finance Project Acting as a revenue aggregator, the project provides liquidity to other decentralized finance pools in exchange for winnings for LPs.

According to source Hackers took advantage of this mechanism and harnessed it in an attack on Curve’s Y complex.

We are actively working on the issue of mitigating the economic attack on the Stablecoin and BTC pools, and will update on this topic in real time as more details become available.

Read:Ripple aims to turn everyone into a bank through its new platform… Details here

– Harvest Finance (@ harvest_finance) October 26, 2020

According to the aforementioned source, arbitrage manipulation using a $50 million fast loan enabled the attackers to extend the price of stablecoins on Curve’s Y pool.

The hackers then used the stablecoin and bitcoin combinations of the Harvest Finance protocol to get a larger amount of stablecoins in exchange for the high-priced Curve-denominated coins.

Then, in less than seven minutes, the attackers drained $24 million of Harvest’s cash.

The total volume of USDT and USDC stablecoins on Curve increased from $10 million to over $2.7 billion during the exploit.

The nature of the attack is discussed in detail In the academic paper, researchers from Imperial College London (ICL) focus on how flash loans can be used to manipulate the price of crypto pairs and drain liquidity from DeFi pools.

Daily there are new hacks targeting decentralized finance projects:

There is a striking similarity between the “Harvest Finance” hack and the attack on Project Eminence, which caused a loss of $15 million, part of which was returned by the attackers to the main developer’s address.

Read:Institutional activity towards Bitcoin is up 8 times from 2017 and interest in buying dips has increased

In Project Eminence, the hacker returned half of the money to the main developer, while the Harvest hacker returned 10% of the total stolen money.

Which raises doubts about who is behind these attacks, which could be one party that is well-versed in the field of decentralized finance.

The striker sent some money because they are good people. If this isn’t hard evidence that “attacker” and “developers” are the same, I don’t know what is.

Read:Ripple Petition to the White House Gets Over 35,000 Signatures

– Riccardo Spani (@fluffypony) October 26, 2020

For the record, the developers of the “Harvest Finance” project are anonymous, which made many red flags appear about their identity and background, especially in similar hacks.

Read also:

Hackers donate $20,000 worth of stolen bitcoin to charitable organizations

Rare cards on Ethereum representing crypto characters are sold at attractive prices