The world of decentralized finance (DeFi) suffered yet another incident on April 19 as Chinese lending platform Lendf.me, part of the dForce network, was drained of almost all of its funds.
The hack is shaping up to be different from others, as the hacker seems to be negotiating with the founders of the protocol.
As reported by Cointelegraph yesterday, the attack occurred at 8:45 AM Chinese time on April 19, which corresponds to 8:45 PM Eastern time on April 18. The attacker leveraged a well-known vulnerability in the expanded ERC-777 token standard called reentrancy attack.
How did the hack work?
The hacker used the imBTC token as the Trojan horse of the attack. It is one of many Ethereum (ETH) wrappers for Bitcoin (BTC), which was written according to ERC-777 specification. This is considered a more advanced but also more vulnerable version of the common ERC-20 standard — especially when used in a DeFi context.
The hack exploited this by combining it with a crucial flaw in Lendf.me’s contracts and how they updated the user’s balance.
As an analyst going by the pseudonym of Frank Topbottom explained on Twitter, the hacker executed many iterations of a simple attack.
In every single transaction, the hacker deposited imBTC on the Lendf.me platform, which was registered on his account’s balance. A second deposit from the same transaction would add a minuscule amount of imBTC, which would allow using a “reentrancy” to withdraw the previously deposited tokens.
Crucially, the contract failed to update the hacker’s balance when withdrawing money. He was thus free to deposit the BTC again, doubling his balance each time.
Eventually, the hacker siphoned almost the entirety of the imBTC present on the platform, amounting to some 291 imBTC ($2 million), according to the analyst.
He then continued to perform the same attack, which at this point simply inflated his balance until its value covered the entirety of the funds held by the protocol.
Finally, he used the fake balance as collateral to borrow almost every single token available on the Lendf.me platform, carrying off about $25 million in various cryptocurrencies and stablecoins.
The hacker already got partially busted
Shortly after the attack, an interesting exchange of on-chain messages occurred.
The hacker sent three transactions of PAX tokens summing up to $250,000 to 1inch.exchange, ParaSwap and an account identified as “Lendf.me admin.” This is most likely a symbolic gesture, as pax means “peace” in Latin.
Lendf.me replied with an email address to contact and then signaled that it had responded to the hacker’s inquiry. Later he returned Huobi-issued assets to Lendf.me, worth about $2.6 million.
Lendf.me finally sent a message with a mildly threatening tone, saying “Contact us, for your better future.”
Sergej Kunz, the CEO of 1inch.exchange — a decentralized exchange aggregator that the hacker used to exchange some of the funds — explained to Cointelegraph that the cybercriminal leaked important metadata about himself by directly using its web-based content delivery network, instead of the IPFS-based frontend.
Specifically, all three exchange requests came from a single Chinese IP address, which suggests that the hacker did not use a decentralized network like Tor. Kunz theorized that this is a VPN or a proxy server, which may be liable to subpoenas.
The hacker is also known to have been using a Mac, revealing his screen’s resolution and system language, which was set to “en-us.”
It is worth noting that this data is trivial to obfuscate, but the high amount of uncommon details in this metadata suggested to 1inch that it was simply an oversight. He concluded:
“He seems to be a good programmer, but an inexperienced hacker.”
As police investigations are already underway, according to Kunz, it appears likely that the hacker will be forced to return the money in hopes of lenient treatment.