Breaking: ‚All funds are at risk‘ — Steadefi exploited in ongoing attack
Decentralized finance (DeFi) app Steadefi was exploited for at least $334,000 on Aug. 7 in an ongoing attack. The app’s development team has said in a social media post that the attack currently „puts all funds at risk.“ The app’s total value locked (TVL) has plummeted as a result of the attack, according to data from DeFiLama.
The Steadefi team posted a message to Twitter stating: „NOTICE: Steadefi has been exploited and all funds are currently at risk.“ They also confirmed that an on-chain message has been sent to address 0x9cf71F2ff126B9743319B60d2D873F0E508810dc on Ethereum in an attempt to negotiate with the attacker. Blockchain data reveals that a number of large inflows came into this address on the Avalanche chain, beginning at 4:41 p.m. UTC.
The tokens transferred to the address include 130,429 US Dollar Coin (USDC), 3.39 Bitcoin (BTC), 15 Wrapped Ether (WETH), and 6,184 Avalanche (AVAX). Aside from the WETH, all other tokens were immediately swapped for WETH. The alleged attacker then bridged 184 WETH onto another network through the Synapse bridge.
The address also appears to have performed a similar series of transactions on the Arbitrum network.
Ethereum blockchain data shows that the development team has sent a message to the attacker offering to let them keep 10% of the alleged stolen funds.
Related: Curve-Vyper exploit: The whole story so far.
After the Steadefi team confirmed the attack, they posted a follow-up message to X (formerly Twitter) explaining how the attack had occurred. The attacker reportedly stole the private key to the team’s deployer wallet, allowing them to perform ownerOnly functions. The exploiter then „went on to take various owner-only actions such as allowing any wallet to be able to borrow any available funds from the lending vaults.“
All loanable funds have been drained by the attacker. However, collateral held in vaults and not lent out has not been drained because the app does not contain an ownerOnly function to remove deposits. As a result, users who deposited to the „strategy“ vaults may still be able to withdraw at least some of their funds.
On the other hand, the attacker paused farming contracts using an ownerOnly function. Therefore, users who deposited svTokens or ibTokens to farms cannot withdraw, and their funds are essentially stuck inside of the app’s contracts. According to the post, most holders of these tokens have deposited into the farms and cannot withdraw.
Exploits have been a continuing problem in the DeFi space. On Aug. 8, Lithuania-based crypto payment firm CoinsPaid said attackers stole $37 million through a fake job interview. On Aug. 4, Curve protocol was exploited for $61 million, although the attacker later began returning some of the funds.
