Pike Finance V1 hack — April 2024

Pike Finance ran a cross-chain lending protocol on Ethereum, Arbitrum and Optimism. On 26 April 2024 an attacker forged a Circle CCTP message and took about $299,000 in USDC, a flaw Pike later said its auditing partner OtterSec had already identified and that the team had not fixed in time. That earlier incident is not counted in the figure recorded here.

The larger loss came four days later and was caused by the fix. To pause the protocol Pike upgraded its spoke contracts and pulled in an additional dependency. The new pause-related state variables shifted the contracts' storage layout and the slot holding the initialized flag was overwritten, so the contracts behaved as though they had never been initialised. On 30 April 2024 an attacker called initialize() again, granted itself the privileged role, then used upgradeToAndCall() to install its own implementation and withdraw deposits.

Pike stated the protocol was drained of 99,970.48 ARB, 64,126 OP and 479.39 ETH, figures Merkle Science independently confirmed. CertiK itemised the 30 April losses as $1,433,977.23 on Ethereum, $150,458.95 on Optimism and $100,070 on Arbitrum, a total of $1,684,506. Reporting rounded this variously to $1.6 million and $1.7 million; the itemised CertiK sum is used here. Merkle Science traced the proceeds being consolidated on Ethereum, with 562 ETH sent into the privacy protocol RAILGUN.

Pike initially described the incident as related to a USDC vulnerability, then retracted that, saying the fault lay in its own integration of third-party services rather than in Circle's product. It offered a 20 percent bounty for the return of the funds, which was not taken up, and began refunding some pre-sale deposits. No completed reimbursement of affected lenders could be verified from published sources.