Decentralized lending protocol Ola Finance announced Thursday it suffered an exploit that allowed an attacker to grab $3.6 million worth of crypto.
According to PeckShield, a blockchain security firm that worked with Ola to diagnose the exploit, the attacker took advantage of a so-called “re-entrancy” bug in one of Ola’s smart contracts.
The attack comes after this week’s disclosure of a $625 million exploit of Axie Infinity’s Ronin network – one of the largest in decentralized finance (DeFi) history. While much smaller in comparison, the Ola attack stands as a reminder of how multimillion-dollar thefts – now commonplace in DeFi – continue to pile up as big money flows into lesser-known ecosystems.
Ola’s DeFi protocol operates across several blockchains, and Thursday’s attack targeted its deployment on the Fuse network – an Ethereum Virtual Machine-compatible blockchain with a mere $12.8 million in total value locked (TVL) prior to the attack, according to data compiled by DefiLlama.
The attacker began by withdrawing funds using Tornado Cash, which enables users to transfer crypto without leaving a trace. After transferring the funds to the Fuse network, the borrower used them as collateral to take out loans on Ola’s decentralized lending platform. Taking advantage of the re-entrancy bug, the attacker was then able to remove the collateral without first paying back the loan.
The hacker repeated this process several times across different Ola pools. They then transferred the drained funds to wallets on Ethereum and BNB Chain.
Ola has paused the use of its lending protocol on Fuse network and tweeted that it will soon publish an “official report detailing the exploit.” The project says its services on other blockchains were unaffected by the exploit and will remain operational.
This is not the first, nor the largest re-entrancy attack in recent memory.
Little more than two weeks before the Ola attack, two lending protocols on the Gnosis blockchain suffered similar exploits. The DAO attack in 2016, an infamous exploit that led to an Ethereum hard fork, was also a version of a re-entrancy attack.