Hundred Finance hack — April 2023

Hundred Finance, a Compound-fork lending protocol, lost about $7.4 million from its Optimism deployment on 15 April 2023, shortly after 14:00 UTC. The protocol confirmed the exploit the same day and published a post-mortem on 23 April.

The attack combined two flaws in the forked code. The attacker first reduced the supply of an unused hWBTC market to a residual amount — 2 wei, per BlockSec — then donated a large quantity of WBTC directly to the contract, inflating the exchange rate between WBTC and hWBTC by orders of magnitude. A rounding error in the redemption path meant redeeming underlying tokens burned fewer hTokens than it should, so a tiny hWBTC balance could be used as collateral against most of the pool. BlockSec's analysis of the attack transaction describes an Aave V3 flash loan funding the donation, with the attacker recovering the donated WBTC plus about 1,021 ETH of profit before repeating the pattern against other markets.

Decrypt itemised the assets taken as roughly 1.27 million USDC, 1.11 million USDT, 843,000 DAI, 865,000 sUSD, 457,000 FRAX, 20,854 SNX and 1,030 ETH. Every detailed account located — Decrypt, BlockSec, Halborn, DL News and rekt.news — puts the total at about $7.4 million.

Hundred Finance offered a $500,000 bounty for information leading to an arrest, then offered the attacker 10% of the proceeds — around $740,000 — to return the rest. The attacker never responded. Token holders voted on 9 August 2023 to wind the protocol down and use the remaining treasury to compensate depositors. DL News reported that the stolen funds, which had been sitting in Curve, began moving again in May 2024.