Hundred Finance is known to be the multi-chain lending protocol, took to its website on Saturday to announce about the attack. Stating that the hacker was able to siphoned around $7.4 million on the Ethereum layer-2 blockchain Optimism.
#CertiKSkynetAlert 🚨@HundredFinance’s attacker manipulated the exchange rate between ERC-20 tokens and htokens which allowed them to withdraw more tokens than they had originally deposited. The estimated losses of this attack is around $7.4 million.
Stay vigilant! https://t.co/1hxAnFoNjj
— CertiK Alert (@CertiKAlert) April 15, 2023
The hacker was able to penetrate the Ethereum layer-2 blockchain Optimism and manipulate the exchange rate between tookens and Hundred Finance interest-bearing equivalents (hTOKENS). The hTOKENS is the tokenized representations of user deposits, on Hundred Finance’s website, which can fluctuate in value depending on the activities of other borrowers.
The hacker did this by using wrapped Bitcoin, an Ethereum-based token that’s backed 1:1 by Bitcoin. The hacker donated a very large sum of wrapped Bitcoins into the smart contract on Hundred Finance that determined the exchange rate between wrapped Bitcoin and Hundred Finance Wrapped Bitcoin (hwBTC).
This resulted to a very large inflation in the exchange rate on the Hundred Finance’s website, after which the hacker the collected a loan and was then was able to get the amount they had donated back by redeeming a relatively small amount of Hundred Finance Wrapped Bitcoin. This was explained by CertiK firm after investigation, stating how the hacker walked away with the $7.4 million worth of digital assets .