- Compounding yield optimizer Grim Finance has revealed that $30 million has been stolen from its platform.
- The DeFi protocol confirmed that it was an “advanced attack,” and deposited funds are at risk.
- Grim has contacted Circle and DAI to attempt to stop further fund transfers.
Decentralized finance (DeFi) protocol Grim Finance has been hacked for $30 million worth of tokens in an “advanced attack.” Grim stated that it had notified Circle (USDC), DAI and AnySwap regarding the hacker’s address to potentially freeze further fund transfers.
Hacker uses re-entrancy attack to steal crypto funds
Grim Finance is built on the Fantom Opera blockchain, a smart contract platform compatible with Ethereum. Users can earn extra value from liquidity provider tokens from decentralized exchanges by depositing funds in the Grim vault.
The hacker leveraged a re-entrancy loophole, which allowed the attacker to add additional fake deposits into a vault while the initial transaction was processed, deceiving the protocol. According to the team that confirmed the attack, the estimated loss of the exploit is over $30 million.
All deposits into Grim Finance vaults have been paused to avoid further exploitation as of December 19. The team noted that some vaults would be unpaused for users to remove their funds. All funds deposited remain at risk since the exploit occurred in the vault contract.
Around an hour before the malicious token contract was created and used by the hacker, the perpetrator funded both Ethereum and Binance Smart Chain wallets from Tornado cash. The attacker then laundered the funds through stablecoin transfers by bridging the stolen digital asset funds from the Fantom mainnet to the ETH mainnet for USDC and DAI.
Grim Finance further stated that it had contacted Circle (USDC), DAI and AnySwap regarding the attacker’s address to halt further fund transfers.
Including the recent Grim Finance hack, over $600 million in crypto funds have been stolen from platform attacks so far in December.
Grim Finance token Reaper dropped over 80% to a low of $0.006 on December 19 following the attack. The team behind the DeFi protocol has notified users on Twitter to await further updates from the team as it monitors the situation. Grim added that other projects on the chain have reached out to the yield optimizer, including Beefy, Tomb, SpiritSwap and FTM Alerts.