The perils of DeFi: How a hacker lost $560,000 in cyberspace

By Robert Stevens

A large investor, otherwise known as a whale, has lost a lot of money by trying to exploit a decentralized finance (DeFi) protocol.

Here’s what happened, according to DeFi Weekly: As part of a new upgrade, iEarn published some smart contracts, filled to the brim with stablecoins. But they hadn’t told anyone. Still, a rich user got wise, and thought they could manipulate those smart contracts to steal the stablecoins, which were held in the form of BUSD and USDT.

The whale tried manipulating the exchange rate between the two stablecoins. They deposited $146,000 into Curve and kept swapping between the coins. They made money by taking advantage of slippage.

Slippage occurs when large trades are made in a pool with low liquidity. The size of the trade massively affects the price of the tokens being traded, which can make trades less or more profitable—depending on which side of the trade you’re on.

The whale put $146,000 into the protocol. Then kept adding and withdrawing more money. By the end, they had $560,000 tied up in it—a mixture of their own money and other people’s.

And this is where it all went wrong.

The trades get reversed

Cronje was observing the trades at the time. He thought that someone had made a mistake and had accidentally lost their money. So, to solve the problem, he enlisted a rich friend to return the money in the pools back to the original owner.

But it didn't work. The long and short of it is that the whale ends up losing the $560,000, the majority of which went to Cronje’s rich friend. A third party, who also was trying to get involved in the scheme ended up taking home $3,500. For the developers among you, read the convoluted details here.

Cronje had only started building iEarn in January. Within weeks it was holding $8 million in its smart contracts. As a result of the community backlash, Cronje decided to let go of the project. Some members of the community have since apologized.

Will Cronje come back to the DeFi space? "Busy re-evaluating that question," he said. But if the community hounds all developers like this, there won't be a DeFi space for him to come back to.

Recommended News