Ola Finance Exploited for $4M in Latest DeFi Hack

Hacker Took Advantage of a Re-Entrancy Bug 

PeckShield, blockchain security, and data analytics company, unveiled in a Twitter thread on how the attackers managed to drain Ola finance’s liquidity. As per PeckShield's analysis, the attack became possible after the hacker took advantage of a re-entrancy bug in one of Ola’s smart contracts.

The attacker began by withdrawing funds using Tornado Cash which allowed him/her to transfer the crypto without leaving a trace. After transferring the funds to the Fuse network, the borrower used them as collateral for issuing loans on Ola’s lending platform. The attacker was then able to remove the collateral without paying back the loan by taking advantage of the re-entrancy bug.

The hacker repeated this process several times across different Ola pools. Lastly, they transferred the drained funds to wallets on Ethereum and BNB Chain.

DeFi Hacking Spree Continues

Ola has paused its lending protocol on the Fuse network and that it will soon publish an “official report detailing the exploit.” Meanwhile, its services on other blockchains were unaffected by the exploit and will remain operational.

This is not the first, nor the largest re-entrancy attack in crypto’s history. Just two weeks ago, two lending protocols on the Gnosis blockchain suffered similar exploits. In fact, the infamous 2016 DAO attack that led to an Ethereum hard fork was also a version of a re-entrancy attack.