EasyFi hack — April 2021

EasyFi was a lending protocol forked from Compound, running on Polygon and Ethereum with a deployment on BNB Chain. On 19 April 2021 an attacker used administrative keys to drain its money markets. EasyFi said hackers attacked the machine of founder Ankitt Gaur remotely to reach the mnemonic and admin keys; Crypto Briefing reported that the compromise allowed the MetaMask browser extension on that machine to be altered. The smart contracts themselves were not exploited, and EasyFi stated that its pool contracts on BNB Chain remained unaffected.

Two separate things were taken, which is why published totals differ by more than a factor of ten. EasyFi's own account puts the user deposits drained from its USDT, USDC, MATIC, ETH and DAI markets at about $6 million; Crypto Briefing reported those were converted into 123 bitcoin through RenBridge. Separately, roughly 2.9 to 3 million EASY tokens were taken from protocol contracts - EasyFi and Crypto Briefing say about 2.98 million, The Defiant about 2.89 million. Priced at the pre-incident market rate, that token block came to roughly $61 million by The Defiant's calculation at about $20.50 per token, or about $75 million by Crypto Briefing's at about $25, producing headline totals between $60 million and $81 million. EasyFi said the tokens were largely prevented from being sold, and it then hard-forked EASY into a new token, EZ, which voided the stolen supply.

EasyFi published a compensation plan on 2 June 2021 under which depositors with net balances at or below $1,000 would be made whole in the deposited assets, while those above $1,000 would receive 25% upfront in the deposited assets and the remaining 75% as EZ IOUs issued at a 25% discount to the EZ spot price. Distribution was announced as starting on 2 June 2021 and completing within 48 hours; no cited source confirms the final outcome.