A flaw has surfaced in the operations of Beanstalk Farms, a stablecoin protocol, which allowed an unknown threat actor to siphon €182 million from the network.
A stablecoin is a cryptocurrency token pegged to a regular coin or other stable asset, such as gold. As such, stablecoins have a stable value compared to more volatile cryptocurrencies such as bitcoin.
Beanstalk Farms is a stablecoin protocol that runs on the Ethereum network and issues the BEAN governance token, which gives owners voting power for any changes to the network itself.
quick loans
Describing the incident in a Discord message, the company said the attacker discovered a vulnerability in its governance system, made possible by a flash lending service. No malware, stolen passwords, or false identities were used in the attack.
Flash loans are just like regular loans, with the only difference being that they happen in an instant. These instant loans are made possible by the unique nature of blockchain technology. However, in this particular case, the quick loans helped the attacker to steal the protocol money. The threat actor used the Aave flash loan service to purchase a large amount of BEAN.
Now in possession of a large chunk of BEAN, the attacker was able to push through a malicious governance proposal and divert all funds from the protocol to a private ETH wallet.
“Beanstalk did not use a flash loan strength metric to determine the % of Stalk that voted for BIP,” the Discord post read. "It was guilt that allowed the hacker to exploit Beanstalk."
A portion of the funds (€250,000) was sent to a Ukrainian aid wallet, CoinDesk reported. It is currently unclear if the company will reimburse affected customers.
Crypto hacks are becoming more devastating by the day. Earlier this year, hundreds of millions of dollars worth of cryptocurrency was stolen from the Ronin network, which provides the “blockchain bridge” that powers the NFT game Axie Infinity.
Via CoinDesk