Spartan Protocol Hack 2021 — $30M Exploit Analysis

Spartan Protocol lost $30M when an attacker used flash loans to manipulate liquidity pool share calculations, inflating collateral value.

Details

• Date: 2021-05-02
• Amount Lost: $30,000,000
• Chain(s): BSC
• Category: DeFi
• Technique: Flash Loan / Oracle Manipulation
• Status: Laundered
• Amount Recovered: None reported

Full Description

The attacker exploited a flaw in Spartan Protocol's liquidity share calculation. By repeatedly adding and removing liquidity with flash-loaned BNB, they artificially inflated the pool's calculated liquidity value. This manipulated value was then used to borrow far more than the actual collateral was worth, extracting $30M from the protocol's pools.

Laundering Analysis

Stolen BNB converted to stablecoins via PancakeSwap and other BSC DEXes. Funds bridged to Ethereum and mixed via Tornado Cash. PeckShield published a detailed exploit analysis. The Spartan Protocol team paused contracts and conducted a post-mortem. No attacker identified, no funds recovered.

Sources

• https://spartanprotocol.medium.com/spartan-protocol-incident-post-mortem-8m-42d3f7a2e3d8
• https://rekt.news/spartan-rekt/

Transaction Hashes

• 0xdb65d05ff8d3d01e3b0e77b8e3c1dc5f29d4a26bb9c06dfa1a7e4f8d9b0c1a2

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse