Leaderboard
167All-time rank
Furucombo
Feb 27, 2021
$14.0M
Lost
$14.0M
Recovered
$0
Net loss
$14.0M
Unrecovered0% recovered
Furucombo exploited February 27, 2021 for ~$14M via delegatecall hijack. Attacker deployed a fraudulent contract impersonating Aave v2 implementation.
Furucombo failed to authenticate the target, allowing the attacker to drain pre-approved tokens (3,900+ stETH and USDC) from ~22 users.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Delegatecall Hijack
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Feb 27, 2021Exploit executed — $14.0M drained via delegatecall hijack
- Attributed to Unknown
- Recovery status Unrecovered 0%