Lendf.Me lending protocol was drained via ERC-777 reentrancy attack, exploiting the token callback mechanism to repeatedly borrow against the same collateral.
The attacker exploited an ERC-777 token callback reentrancy vulnerability in Lendf.Me (dForce's lending protocol). By depositing imBTC (an ERC-777 token), the attacker triggered the token's callback during deposit to reenter the withdraw function, effectively borrowing against the same collateral repeatedly and draining all protocol assets across multiple tokens.
Unusually, the attacker returned all funds within 4 days after being identified through KYC information at dYdX and IP address metadata they left on-chain. dForce negotiated fund return in exchange for a bounty. Protocol resumed operations. This is one of the few 2020 DeFi hacks where nearly all funds were recovered.
0x0ef0119b9a6c3e3e0cf2b6e44e5ddb10f4c59d0b9e12f8a2c4d6e8f0a2b4c6d8