The hacker responsible for stealing $7.4 million from the decentralized finance (DeFi) protocol Hundred Finance has finally started moving the stolen cryptocurrency assets after a year of inactivity.
On May 1, the hacker transferred Ether (ETH) and Tether (USDT) worth approximately $800,000 from Curve’s decentralized exchange (DEX). These funds were initially provided as liquidity on the platform over a year ago.
After withdrawing the funds, the hacker converted the USDT and other cryptocurrencies into ETH, resulting in an increase of over $1 million in their ETH holdings.
Currently, the hacker holds a total of $4.3 million in assets in their wallet, which includes various crypto assets such as Dai (DAI), Wrapped Ether, Frax, and Wrapped Bitcoin.
The security breach on the layer-2 network Optimism that occurred on April 15, 2023, was reported by the Hundred Finance protocol. According to the blockchain security firm CertiK, the attacker manipulated the exchange rate between ERC-20 tokens and hTOKENS, allowing them to withdraw more tokens than were initially deposited.
This type of attack, commonly known as a flash loan attack in the DeFi world, involves borrowing large amounts of funds without collateral from a lending platform. The attacker then uses these assets to manipulate the price of cryptocurrencies on DeFi platforms. In the case of the Hundred Finance hack, the attacker took out large loans based on falsified exchange rates.
In addition to the recent breach, Hundred Finance also experienced an exploit on the Gnosis Chain in 2022, resulting in a loss of $6 million due to a reentrancy attack.
While flash loan attacks have caused significant damage in the past, the month of April 2024 saw a significant decrease in losses from this type of hack. According to CertiK’s report, flash loan attacks only accounted for $129,000 in losses in April, with the largest incident causing only $55,000 in damages. This represents the lowest amount lost to flash loan attacks since February 2022.
Furthermore, losses from crypto hacks in general also decreased in April. Security company PeckShield reported that only $60 million was lost to hacks during the month, a substantial decline compared to the $360 million and $187 million lost in February and March, respectively.