Hackers liquidate Defrost Finance, triggering a $12m loss

Blockchain security watch firm PeckShield confirmed a flash loan attack in Defrost Finance has led to users losing more than $12 million.

Defrost V1 and V2 under investigation

After a few users complained about significant losses in their accounts, Defrost Finance announced an investigation into a possible hack on its Defrost V1 and V2 platforms. Doran, a core team member, informed the users to refrain from using Defrost V2 through Telegram.

Hackers liquidate Defrost Finance, triggering a $12m loss - 1 — Message by Doran, core community member Defrost Finance. Source: Telegram

At first, the platform thought only Defrost V2 was under attack and decided to shut it down to protect users. The hacker targeted MetaMask Wallets housing users’ staked Defrost Finance (MELT) and Avalanche (AVAX) tokens.

Defrost Finance is sad to announce that our V2 has suffered a hack, with an attacker using a flash loan function to withdraw funds.

The V1 is not affected. We will soon close the V2 UI and investigate further with our tech team.

Updates will be posted on our official channels.

— Defrost Finance 🔺 (@Defrost_Finance) December 24, 2022

In another announcement, Defrost Finance, through Doran, announced its Defrost V1 was also under attack and advised users to withdraw funds in the protocol to avoid further losses.

An initial analysis by PerkShield showed an exploit through manipulation of the flash loan and deposit functions which was possible due to a lack of a reentrancy lock. The hacker used the option to tamper with LSWUSDC’s share price. At the time, the hacker had gained about $173,000.

The @Defrost_Finance is exploited, leading to the gain of ~$173k for the hacker. The hack is made possible due to the lack of reentrancy lock for the flashloan()/deposit() functions, which was used by the hacker to manipulate the share price of LSWUSDC. pic.twitter.com/SINHUZXC0D

— PeckShieldAlert (@PeckShieldAlert) December 23, 2022

Further analysis showed the hacker introduced a face collateral token and used a malicious price oracle to liquidate users in the platform. Losses resulting from the hack are estimated to be more than $12 million.

Defrost Finance is an entirely fair launch trading platform operating in Avalanche blockchain. The company has advised its investors to stop using its platform as the internal team works towards investigating and resolving the issue.

The community did not take Defrost Finance’s announcement literally but viewed it as a tug-of-war situation. The attackers are holding an essential part of the platform, which calls for immediate actions that might save the situation. The management of Defrost Finance is ready to settle with the attackers, thus announcing an offer to hackers in the latest developments.

The Defrost team is willing to negotiate with the hacker(s).

We are willing to discuss sharing 20% (negotiable) of the funds in exchange for the bulk of assets and are calling on the hackers to contact us asap.

— Defrost Finance 🔺 (@Defrost_Finance) December 25, 2022

Frequency of flash loan attacks

On December 10, attackers infiltrated Arbitrum-based borrowing protocol, Lodestar Finance, through a flash loan attack. According to Lodestar, the attacker overstated the plvGLP token and then used the manipulated token to borrow the entire network’s available supply of liquidity. The attacker took more than $5.8 million, but Lodestar confirmed reverting about $2.8 million that helped repay depositors.