Leaderboard
125All-time rank
Harvest Finance
Oct 26, 2020
$24.0M
Lost
$24.0M
Recovered
$0
Net loss
$24.0M
Unrecovered0% recovered
Harvest Finance exploited October 26, 2020 for $24-34M via Curve oracle manipulation. Attacker deployed $50M flashloan to skew the Curve y-pool USDT/USDC balance, then repeatedly minted fTokens at depressed valuation and redeemed at normal price (~30 times in 7 minutes).
How the exploit worked
View reproducible PoCFlashloan Attack.
Lost: $33.8 million
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Oracle Manipulation
- Technique
- Spot Price Manipulation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Oct 26, 2020Exploit executed — $24.0M drained via spot price manipulation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)