Stablecoin Protocol Beanstalk Loses Over $180 Million to Hacker

The attacker took advantage of a loophole to breach the protocol.

Exploited for BEANs

Credit-based stablecoin protocol Beanstalk fell victim to hackers exploiting its system leading to the loss of all its collateral. The protocol lost an estimated total of $182 million worth of cryptocurrency assets.

Peckshield, a reputable blockchain security firm, announced the hack:

“The BeanstalkFarms was exploited in a flurry of txs leading to the gain of $80 million+ for the hacker (The protocol loss may be larger), including 24,830 ETH and 36 million BEAN.”

BEAN is the protocol’s native token.

Peckshield added that its “initial analysis” shows a loss of $182 million. The firm went on to give a breakdown of the exploited digital assets:

• 79,238,241 BEAN3CRV-f
• 1,637,956 BEANLUSD-f
• 36,084,584 BEAN
• 0.54 UNI-V2_WETH_BEAN

On Monday, Beanstalk made an offer to the cybercriminal. It offered to let go of 10% of the exploited bounty for a return of the rest of the loot.

If you will return 90% of the withdrawn funds to the Beanstalk Farms multi-sig wallet 0x21DE18B6A8f78eDe6D16C50A167f6B222DC08DF7, Beanstalk will treat the remaining 10% as a Whitehat bounty properly payable to you.

— Beanstalk Farms (@BeanstalkFarms) April 18, 2022

How it Happened

The hacker responsible seeded the protocol with governance proposals requesting donations for Ukraine. Like many other DeFi projects, Beanstalk’s governance allows its users to vote on code changes. The extent of voting rights aligns with the value of tokens that a user owns.

Armed with this knowledge, the hacker took out a flash loan, a short-term credit facility that lets people borrow huge amounts of crypto. After borrowing nearly $1 billion dollars in DAI, USDC, and USDT, they took over 67% of the governance and approved their proposals.

The hacker funneled the stolen funds through Tornado Cash, a transaction privacy protocol. The platform was used in the same way by those behind the $625 million hack of Axie Infinity bridge Ronin.