DeFi Platform Raft Hacked for $3.3 Million, Attacker Burns Most of Stolen ETH – Here’s What Happened
Decentralized finance (DeFi) platform Raft has suffered a hack resulting in the loss of approximately $3.3 million in Ethereum ( ETH).
However, the attacker’s attempt to profit from the heist may have backfired, as they incurred a loss themselves.
On-chain data reveals that the hacker drained 1,577 ETH from Raft and subsequently sent 1,570 ETH to a burn address, effectively destroying the majority of the stolen assets.
Only 7 ETH remained in the attacker’s possession.
Prior to the attack, the hacker’s address had received 18 ETH through the use of a crypto mixer service called Tornado Cash, likely to fund the transactions.
After executing the transfers and paying the associated blockchain fees, the attacker’s crypto wallet was left with a mere 14 ETH, resulting in a loss of 4 ETH overall.
Following the incident, Raft’s R dollar-pegged stablecoin experienced a significant drop.
Initially valued at $1, it plummeted by 50% but later recovered to around 70 cents, according to Coinmarketcap data.
David Garai, co-founder of Raft, confirmed the attack in a post on the social media platform X (formerly Twitter).
Garai explained that the exploiter minted R tokens, which were subsequently sold to drain liquidity from automated market makers. Simultaneously, collateral was withdrawn from Raft.
“There’s been an exploit situation for Raft where the exploiter minted R (which was then sold to drain AMM liquidity), and also managed to withdraw collateral at the same time.”
There's been an exploit situation for @raft_fi where the exploiter minted R (which was then sold to drain AMM liquidity), and also managed to withdraw collateral at the same time
We are investigating – post-mortem will follow soon
— DG (@davgarai) November 10, 2023
In an effort to mitigate the impact on users, Garai stated that they are using the protocol-owned sDAI in the Peg Stability Module to compensate affected individuals.
Raft functions as a DeFi lending platform and issues the R stablecoin, which is collateralized by liquid staking ether (ETH) derivatives such as Lido’s stETH. Users have the ability to mint R tokens by locking up ETH derivatives.
Poloniex Wallet Drained of $114 Million
Raft’s hack marked the second major crypto exploit on the same day. Earlier, an attacker drained approximately $114 million in digital assets from the centralized exchange Poloniex.
The hacker deployed two wallets sending stolen funds in sequence before swapping them for USD Coin ( USDC) using the Metamask swapping feature.
Following the disclosure of the hack, the company’s Customer Support announced on X that the wallet has been disabled in the meantime.
Our wallet has been disabled for maintenance. We will update this thread once the wallet has been re-enabled.
— Poloniex Customer Support (@PoloSupport) November 10, 2023
The recent incidents come as hacks and scams continue to plague the crypto industry.
According to a report by blockchain security platform Immunefi, there were 76 hacks on crypto and Web3 projects and firms in Q3 2023, a significant increase compared to the 30 hacks reported in the same period in 2022.
In total, approximately $332 million has been lost to various exploits, hacks, and scams throughout September, marking a record-high month for crypto exploits.
