Harvest Finance Hack 2020 — $34M Exploit Analysis

Harvest Finance vaults were drained via flash loan price manipulation of Curve's USDC/USDT pools, exploiting the vault's reliance on spot prices.

Details

• Date: 2020-10-26
• Amount Lost: $34,000,000
• Chain(s): Ethereum
• Category: DeFi
• Technique: Flash Loan / Oracle Manipulation
• Status: Partially Recovered
• Amount Recovered: $2,500,000

Full Description

The attacker used a $50M flash loan to manipulate USDC/USDT prices on Curve Finance's y pool, temporarily pushing the price of USDC below peg. Harvest Finance's USDC vault calculated share prices based on this manipulated spot price, allowing the attacker to deposit and withdraw repeatedly at artificially favorable rates, extracting profit each round.

Laundering Analysis

The attacker converted profits to renBTC and withdrew to a Bitcoin address. Approximately $2.5M was returned to the Harvest deployer address shortly after the attack — possibly a goodwill gesture or error. Remaining $31.5M moved through Bitcoin mixing services. The attacker left a message saying the exploit was 'not intentional' which was widely dismissed.

Sources

• https://medium.com/harvest-finance/harvest-flashloan-economic-attack-post-mortem-3cf900d65217
• https://rekt.news/harvest-rekt/

Transaction Hashes

• 0x35f8d2f572fceaac9288e5d462117850ef2694786992a8c3f6d02612277b0877

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse