Crime & Security1 min readThe AssayerLook-back
Q2 2022 in crypto hacks: a $181 million governance takeover at Beanstalk
Crypto losses in the second quarter of 2022 came to $631.5 million across 43 incidents, half the $1.27 billion of the first quarter. No centralised exchange recorded a loss. DeFi protocols took $622.2 million, 98.5% of the total.
Beanstalk
On April 17, an attacker borrowed over $1 billion in flash loans, money borrowed and repaid within a single transaction, from Aave, Uniswap and SushiSwap. They used it to buy two-thirds of the voting power in Beanstalk, a protocol run by on-chain votes, and passed proposals that drained it. The attacker took about $181 million in assets, 28.7% of the quarter’s losses.
No key was stolen and no code misbehaved. The protocol’s rules allowed it.
Bridges and code
On June 23, Harmony’s Horizon Bridge lost about $100 million. Attackers linked to North Korea’s Lazarus Group compromised validator keys. Only two of five signatures were needed to approve a withdrawal.
Earlier in June, attackers abused a newly deployed function on Elrond to take about 1.65 million EGLD, around $113 million. The team recovered and burned the unbacked tokens. In May, Rari Capital lost about $80 million to a reentrancy flaw in its Fuse lending pools.
A wrong address
One loss came from a mistake. Wintermute, a trading firm, lost 20 million Optimism tokens, about $17.6 million, after giving a multisig wallet address that hadn’t yet been set up on Optimism. An attacker set up a contract at that address first and took the tokens.
Eleven incidents of $10 million or more made up 91.8% of losses.
Sources
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
More on North Korea, Bridge hacks
