Belt Finance hack — May 2021

On the evening of Saturday 29 May 2021 an attacker extracted 6,234,753 BUSD, about $6.23 million, from Belt Finance, a yield vault and stableswap protocol on BNB Chain.

The attacker deployed a contract that took flash loans of BUSD from PancakeSwap and used that size to distort how the beltBUSD vault allocated capital between its underlying strategies. Depositing into one strategy made it register as the most under-funded and another as the most over-funded, so subsequent deposits and withdrawals were priced against vault accounting that did not match the vault's real holdings. The sequence was executed eight times over about ten minutes before the team paused deposits and withdrawals and patched the flaw.

Two different numbers circulate for this incident and they measure different things. Decrypt and CoinDesk both report that the transactions cost the beltBUSD pool 50,030,452 BUSD in total, of which 6,234,753 BUSD was the attacker's profit and the remaining 43,795,699 BUSD was consumed as fees and slippage inside the strategies. Belt Finance measured the damage to users at 21.36 percent for beltBUSD vault depositors and 5.51 percent for 4Belt pool participants, and said no other pools or vaults were affected. The figure recorded here is the amount the attacker took; the roughly $43.8 million difference was value leaked out of the pool rather than funds the attacker received.

On 2 June 2021 Belt published a compensation plan covering 4Belt pool participants, beltBUSD vault users and BELT holders: a snapshot of pre-attack balances, an airdrop of a remedy token called r4BELT in proportion to those balances, and a $3 million fund to buy back BELT. The cited reporting records the plan as announced; it does not confirm the distribution was completed. No funds were recovered from the attacker.