Users on Harvest Finance’s Discord channel reported that they had lost 10-15% trying to un-stake fusdc, with several users in the community soon expressing their concerns about a probable carpet pull.
Truthfully, $FARM was down to over 70% as of now. Having over $500M at risk, hackers are reportedly moving funds into renBTC and attempting to sell it off. According to few community members, funds have been sent to Tornado Cash to be laundered.
“We are working actively on the issue of mitigating the economic attack on the Stablecoin and BTC pools, and will update in this thread in realtime as soon as additional details are available”
— Harvest Finance (@harvest_finance) October 26, 2020
The mentioned economic attack was then performed through the curve y pool, stretching the price of the stablecoins in Curve out of proportion and depositing and withdrawing a considerable amount of assets in Harvest. The protocol added,
“To protect users, we’ve pulled Y pool and BTC Curve strategy funds to the vault.”
As of now, 100% of all stablecoin and BTC Curve strategy funds have been withdrawn from the strategy and then deposited into a vault. Furthermore, the other pools are said to have been affected by the attack.
Harvest also released a statement that claims their next steps to secure the users to move the block deposits to the Stablecoin and BTC vault. Meanwhile, the existing deposits will endure earning $FARM. Eventually, after claiming that the 7-minute attack had originated after a huge flash loan, the protocol tweeted,
“The attacker sent back $2,478,549.94 to the deployer in the form of USDT and USDC. This will be distributed to the affected depositors pro-rata using a snapshot.”
Mixed feelings have greeted the abovementioned revelation by many in the community, Riccardo Spagni commented,
“The attacker” sent some funds back because they’re such friendly people. If this isn’t strong evidence that “the attacker” and “the devs” are the same, then I don’t know what is.”
Remarkably, Chris Blec said that the $2.5M worth of stablecoins was transferred into Harvest Finance’s anon developer admin key address from the hackers’ contract.
No Comment