Investigating the Separate Attacks that Hacked DeFi Protocols

Exploitation of DeFi Protocols Exactly and Harbor

On Aug. 18, two separate — and apparently unrelated — attacks were carried out on decentralized finance (DeFi) protocols Exactly and Harbor, according to blockchain security firms DeDotFi and PeckShield. Data.AI revealed that 4323.6 Ether (ETH), worth around $7.3 million at the time, had been stolen from Exactly Protocol. The hackers then bridged 1490 ETH using the Across Protocol, and 2,832.92 ETH to the Ethereum network via Optimism Bridge.

Exactly is one of the crypto lenders on the Optimism network. Initially, it was reported that 7160 ETH, worth almost $12 million, had been taken, but the amount was later revised. The attacker targeted the DebtManager periphery contract, according to Exactly. The protocol has filed a police report and is attempting to communicate with the attackers in an effort to return the stolen assets, its team noted on X (formerly Twitter).

In another security incident, Harbor, the interchain stablecoin protocol, revealed that it had been the victim of an attack that resulted in the loss of funds from its stable-mint, stOSMO, LUNA and WMATIC vaults. At this time, the amount of crypto assets stolen is still unknown. Harbor is aiming to trace the funds and assess the total losses.

These attacks follow a string of security incidents that have occurred in the DeFi space over the past few weeks. On July 30, an exploit on three versions of the Vyper programming language led to the theft of more than $61 million from stable pools on Curve Finance. Other protocols that were compromised recently include Earn.Finance, with the loss of at least $287,000 worth of ETH, and Zunami Protocol, which experienced a breach that resulted in $2.1 million in losses.