On Sunday, blockchain security firm Peck Shield reported a hack of $182 million from the Beanstalk farms through a flash loan exploit.
Reportedly, the attacker obtained a considerable amount of loan from Beanstalk’s native governance token, Stalk by taking a flash loan on Aave lending platform. Further investigation showed that the attacker was able to approve a malicious governance proposal that siphoned off all the protocol money into a private Ethereum wallet thanks to the voting power granted from Stalk tokens.
Interestingly, the attacker also donated $250,000 worth of the stolen funds to the Ukrainian relief wallet with the rest laundered through the coin mixing service called Tornado Cash. At the time of writing, Peck Shield found that 15,154 ETH remains in the hackers' account.
Beanstalk’s smart contracts were audited by the blockchain security firm Omnicia. However, the audit was completed before the introduction of the flash loan vulnerability, according to a blog post from the security firm on Sunday.
Beanstalk Farms is the latest in a string of major decentralized finance (DeFi) exploits to occur in the past few weeks. In March, Axie Infinity’s Ronin network was exploited for $625 million which U.S. officials recently linked it to North Korea.