Key Takeaways
- An unknown hacker has stolen $30 million from the Fantom-based DeFi project Grim Finance.
- The hacker exploited a reentrancy bug in the project’s smart contracts.
- Following the attack, Grim Finance’s total value locked has tumbled from $98.9 million to $4.2 million, while its native token GRIM is down 70%.
Grim Finance, a DeFi protocol built on Fantom, has become the target of a $30 million hack.
Fantom Project Hit By $30 Million Hack
Grim Finance has been hacked.
This weekend, an unknown attacker stole $30 million from the project’s yield vaults.
The Grim Finance team announced the attack in a Sunday tweet, revealing the total losses and that it had identified the hacker’s address.
Hello Grim Community,
It is with heavy hearts that we inform you that our platform was exploited today by an external attacker roughly 6 hours ago. The attackers address has been identified with over 30 million dollars worth of theft here https://t.co/qA3iBTSepb
— Grim Finance (@financegrim) December 19, 2021
Grim Finance is a DeFi project built on Fantom. It functions similarly to the popular Ethereum protocol Yearn.Finance, letting users deposit crypto assets like FTM to “vaults.” The project’s vaults use complex multi-step strategies across DeFi to generate lucrative yields for users.
The team described the incident as an “advanced attack” in which a hacker exploited a reentrancy bug to steal funds deposited in its vaults. The hacker used the bug to drain over $30 million worth of FTM. Their transaction history shows a paper trail of interactions with Fantom-based decentralized exchanges like SpookySwap, where they exchanged their stolen tokens for stablecoins.
The DeFi space has seen millions of dollars worth of losses due to other similar reentrancy bugs over the last year. In August, an attacker exploited a reentrancy bug in Cream Finance’s smart contracts to steal $17.6 million. They later returned the majority of the funds.
Following the hack, the Grim Finance team announced that it had paused its vaults and notified Circle, Maker, and AnySwap to “potentially freeze” further transfers. The total value locked in the protocol, meanwhile, has tumbled from $98.9 million to $4.2 million following the incident, per data provided by DeFiLlama. The GRIM token is also down about 70% following the attack, trading at $0.23 at press time.
Disclosure: At the time of writing, the author of this piece owned ETH and other cryptocurrencies.
