Ethereum-based stablecoin protocol Beanstalk Farms has lost more than $181 million in cryptocurrencies as a result of a hack. The hacker received about $76 million.

1/5

new popular @beanstalkfarms protocol lost $181M+ in today’s exploit, but the attacker only made $76M.

Let’s understand what it is pic.twitter.com/sRjzAF8stE

— Igor Igamberdiev (@FrankResearcher) 17 April 2022

According to The Block research director Igor Igamberdiev, the attacker completely emptied the protocol agreement.

The attacker created a control proposal BEEP-18 provided a donation in favor of Ukraine of $250,000, which he falsified before his execution.

Through instant loans, he received:

• 350M DAI, 500M USDC and 150M USDT in Aave;
• 32 million BEAN on Uniswap;
• 11.6 million LUSD at SushiSwap.

The funds were used by the hacker to add liquidity to Curve pools in BEAN and to get control votes – Stalk tokens.

It then deployed and sanctioned the malicious BIP-18, which transferred all assets from the protocol to a third-party wallet.

2/5

The main protocol agreement was completely emptied.

User funds withdrawn:
– 36M BEANS ($36M)
— 0.54 ETH-BEAN UNI-v2 LP tokens ($33M ETH and $32M BEAN)
— 79.2 million BEAN3CRV-f Curve LP tokens ($79.2 million?)
— 1.6 million BEAN-LUSD Curve LP tokens ($1.6 million?) pic.twitter.com/mdnr9rCDbm

— Igor Igamberdiev (@FrankResearcher) 17 April 2022

The attacker turned the remaining funds into 24,800 WETH (~$76 million) after removing liquidity and repaying loans. He laundered cryptocurrency through the Tornado Cash mixing service. 250,000 USDC went to the donation address for Ukraine.

The company Omnicia, which previously audited the Beanstalk protocol, said that the vulnerabilities used for the attack emerged after checking the code base. The Firm noted that the ability to generate governance tokens via instant loans and immediate implementation of a proposal accepted by a qualified majority has been implemented by BIP-12 and BIP-16 in recent months.

📌 Read our post-mortem analysis of the Beanstalk abuse. The exploited code is NOT INSPECTED by the omniscia team https://t.co/Ck08mJBazJ pic.twitter.com/S6SO7YaVrw

— Omniscia (@Omniscia_sec) 17 April 2022

Recall that the biggest crypto project hacks since the beginning of the year were the Wormhole and Ronin events – $319 million and $625 million lost respectively.