BiFi USDT market hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 18, 2026 |
| Target type | Lending protocol |
| Loss | $165,575Price at time of incident |
| Method | Contract logic errorAn idle market charged its whole 36-day interest gap on every action in the first active block, at a utilisation rate the caller could set through permissionless deposits and borrows, so inflated deposit interest could be withdrawn |
| Chains | Ethereum |
| Outcome | Unresolved |
What happened
The USDT market of BiFi, a lending protocol on Ethereum, lost about 165,575 USDT on 17 October 2026. This registry read the transaction at 05:43:11 UTC: the market’s USDT handler paid out 165,575 USDT more than it took in, and the surplus was swapped to 68.06 WETH.
According to the DeFiHackLabs reconstruction, the market had been idle for 264,059 blocks, about 36.7 days. BiFi accrues interest lazily: the first action in a block stores the whole idle gap, and every later action in that block charges the full gap at a rate taken from the market’s live deposit and borrow totals. Deposits and borrows are permissionless, so the caller sets the utilisation. The attack flash-borrowed 40.5 million USDT from Morpho, deposited it, borrowed to push utilisation up, ran a repay-and-withdraw loop twice to cash out the inflated deposit interest, and repaid the loan.
An exploit contract was deployed one block earlier, but the profitable transaction was sent by c0ffeebabe.eth, an MEV bot that copies pending exploits and has returned the proceeds in past incidents. By 21 October this registry had found no return to BiFi and no statement from BiFi.
Sources
- Ethereum transaction draining the USDT market, read by this registryOn-chain · retrieved 2026-10-21
- DeFiHackLabs, proof of concept and analysisSecondary · retrieved 2026-10-21
- Ethereum transaction deploying the original exploiter’s contract one block earlierOn-chain · retrieved 2026-10-21
Changes to this entry
- Recorded from DeFiHackLabs’ reconstruction, checked against our own read of the transaction. Will move to funds returned if c0ffeebabe.eth returns the proceeds.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "BiFi USDT market hack — October 2026", iTokenly, accessed 2026-10-21, https://itokenly.com/hacks/bifi-usdt-market-october-2026https://itokenly.com/hacks/bifi-usdt-market-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.