A DeFi project, the Meter Passport token bridge platform, suffered a loss of $4.4 million. Behind this is a smart contract hack that caused Hundred Finance to lose $3.3 million in undercollateralized loans. As Kriptokoin.com, we convey the details…
DeFi project hacked: $4.4 million lost
Meter.io’s Meter Passport (MTRG) is a token bridge compatible with Ethereum and side-chains. This attack affected the Moonriver side of the bridge. Moonriver is a smart contract platform based on Polkadot’s Kusama network. Hundred Finance is a crypto loan platform based on Compound Finance code. According to Meter’s February 6 statement, during various transactions on February 5, $4.4 million worth of Binance Coin (BNB) and wrapped Ethereum (wETH) were minted, falsely assuming collateral. That is, an arbitrary amount of ETH was invested in the Meter, which the hacker used to print the tokens with the vulnerability.
The attack caused a cascading impact on the Kusama-based Moonriver ecosystem. After draining Meter’s BNB and wETH reserves, the attacker sold BNBs on SushiSwap, a popular decentralized exchange. This led to a 77 percent crash in BNB price on Moonriver at the time. Meanwhile, opportunists took advantage of the price drop by buying cheap BNB. They used the tokens as collateral on Hundred Finance in exchange for ETH, FRAX and MIM loans. However, due to the difference in BNB price, their loans were more valuable than the collateral they provided, causing a supply crisis.
2,000 ETH and 2.74 BTC received
Surprisingly, two of the loans were repaid, leaving the Hundred protocol a loss of $3.3 million. The Hundred team tried to reach out to interested parties to request that they return the BNB tokens used as collateral to Meter. The Meter team has committed to compensate its community and Hundred Finance for losses incurred due to the hack. Blockchain security firm PeckShield estimates that a total of 1,391 ETH and 2.74 wBTC were taken by the attacker, and the tokens have since been sent to Ethereum via Tornado Cash, a tool to hide ETH transactions.
35677
