Uranium Finance (2021) — Crypto Hack
LaunderedA miscalculation in Uranium Finance's v2 migration code left a factor-of-100 error in the AMM balance check, enabling $50M to be drained.
Summary
A miscalculation in Uranium Finance's v2 migration code left a factor-of-100 error in the AMM balance check, enabling $50M to be drained.
How It Was Compromised — DeFi via Smart Contract Exploit
During migration to Uranium v2, a critical bug introduced a 100x error in the balance calculation used to verify trade validity. An attacker discovered this and exploited it to extract nearly all assets from the liquidity pools in a single transaction. The exploit was simple: unbalanced swaps passed due to the miscalculation.
Fund Flow & Laundering Analysis
Stolen funds converted to BUSD and BTC. BTC portion moved through Bitcoin mixers. BUSD portion exchanged for ETH on Ethereum via bridges and laundered via Tornado Cash. Uranium Finance team never recovered funds and no attacker identified. Protocol shut down.