Harvest Finance urged hacker to return stolen crypto assets to users

Harvest Finance developers revealed detailed information about the hacking of the Defi protocol on $34 Milln and asked the hacker to return the stolen crypto assets to users.

The developers told the Harvest Finance blog, how the attacker managed to steal the reserves of the USDC and USDT from storage facilities. The project team also published updated information about the dollar value of stolen crypto assets. It was previously assumed, that the hackers managed to get $25 million, However, the amount of damage as a result was $34 million.

The attacker gave himself quick loans, which allowed him to temporarily manipulate the reserves of Harvest Finance, stored in the Curve protocol. Fast loans led to a decrease in the cost of USDT and USDC on Harvest, which allowed the attacker to buy crypto acts much cheaper than their real price. In this way, The hacker repaid loans and received additional profits.

The attack led to a sharp drop in the cost of the Harvest Finance Farm token. According to Coinmarketcap, Its price fell with $242 On Sunday before $100 at the moment.

“We made an engineering mistake, And we recognize her ", - said the Harvest Finance team on the blog.

To prevent such attacks in the future, The developers have proposed several solutions. First of all, make it impossible to introduce and withdraw funds within the same transaction, ie. eliminate the functionality of fast loans. Secondly, Add the converting of Curve tokens to stablcoins in separate transactions, which will minimize damage from a quick loan.

The creators of the protocol plan to eliminate vulnerability in the near future and ask the hackers to meet. On the social network Twitter, the project developers wrote:

“For an attacker: You have proved your point of view, If you can return money to users, This will be highly appreciated by the community, including many third -party Defi observers ".

Harvest Finance offers a reward in the amount $100 000 man, who will convince the attacker to return the crypto assets, or $400 000, If this happens in the coming days.