An unknown actor siphoned assets worth about $11.3 million from the Rari Capital DeFi protocol.
The Block researcher Igor Igamberdiev noted that the attack marked the first cross-chain exploit — the funds for it were stolen from Value, a project operating on Binance Smart Chain (BSC). The hacker withdrew 5,346 BNB, which were exchanged for 1,000 ETH.
2/7
Hackers obtained funds to attack Rari by stealing them from vSafe from @value_defi on BSC (4th attack).
Unfortunately, I was concentrating on the AMM exploit, so I didn’t notice that their yield farm was also affected.
5,346 BNB ($3.8M) were stolen and swapped to 1k ETH. pic.twitter.com/7rn5omjyK3
— Igor Igamberdiev (@FrankResearcher) May 8, 2021
According to the expert, the attack on Rari Capital involved creating a fake token and its pool on SushiSwap.
Subsequently, the hacker, interacting with Alpha Homora, obtained ibETH in the Rari ETH pool contract. He exchanged the assets there for Ethereum.
Repeating the steps several times, the attacker withdrew 2,900 ETH, while 1,700 ETH was saved by the Rari team.
“Interactions between DeFi protocols are becoming increasingly complex, which opens up new attack vectors,” noted Igamberdiev.
The governance token price of Rari collapsed by almost half after the incident — from $18.41 to $9.51. At the time of writing, the asset trades just below the $14 level.
Earlier in May, the hacker pulled tokens worth $30 million from the Spartan Protocol on Binance Smart Chain.