Uranium Finance Hack 2021 — $50M Exploit Analysis

A miscalculation in Uranium Finance's v2 migration code left a factor-of-100 error in the AMM balance check, enabling $50M to be drained.

Details

• Date: 2021-04-28
• Amount Lost: $50,000,000
• Chain(s): BSC
• Category: DeFi
• Technique: Smart Contract Exploit
• Status: Laundered
• Amount Recovered: None reported

Full Description

During migration to Uranium v2, a critical bug introduced a 100x error in the balance calculation used to verify trade validity. An attacker discovered this and exploited it to extract nearly all assets from the liquidity pools in a single transaction. The exploit was simple: unbalanced swaps passed due to the miscalculation.

Laundering Analysis

Stolen funds converted to BUSD and BTC. BTC portion moved through Bitcoin mixers. BUSD portion exchanged for ETH on Ethereum via bridges and laundered via Tornado Cash. Uranium Finance team never recovered funds and no attacker identified. Protocol shut down.

Sources

• https://rekt.news/uranium-rekt/
• https://bscscan.com/tx/0x5a504fe72ef7fc76dfeb4d979e533af4e23fe37e90b5516186d5ae932c5610

Transaction Hashes

• 0x5a504fe72ef7fc76dfeb4d979e533af4e23fe37e90b5516186d5ae932c5610

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse