Indexed Finance hack — October 2021

On 14 October 2021 an attacker emptied two of Indexed Finance's index pools on Ethereum, DEFI5 and CC10, taking assets worth about $16 million, roughly $11 million from DEFI5 and $5 million from CC10.

Indexed's index pools re-weighted themselves over time, and when a new token was added the controller used an approximate value derived from a Uniswap oracle to decide how much of it the pool should hold. The attacker triggered a re-index, then used flash swaps of around $156 million to dump borrowed tokens into the pool, depressing its apparent value. Calling the minimum-balance update at that moment set the target balance far too low, which let the attacker mint index tokens far in excess of what they had contributed and then burn them to claim the underlying assets. The pools held large-capitalisation DeFi tokens including UNI, AAVE, COMP, CRV, MKR, SNX, LINK and YFI. The two pools were left holding around $288,000 and $2 million respectively, and the NDX governance token fell about 22 per cent on the day.

The contracts had been looked over before launch by Daniel Luca, formerly of ConsenSys Diligence, and Sushi developer Mudit Gupta; neither found the flaw. Indexed published a post-mortem the next day and its DAO voted between 27 October and 2 November on a compensation scheme, issuing redeemable claim tokens covering 99.32 per cent of losses for direct holders of DEFI5, CC10 and FFF and 88.5 per cent for liquidity providers, funded from assets extracted from the affected pools and protocol revenue.

In February 2025 the US Department of Justice charged Canadian national Andean Medjedovic over this attack and the 2023 KyberSwap exploit.