Beanstalk Farms loses $182 million in security breach

The market for Beanstalk’s BEAN stablecoin collapsed as a result of the attack

Credit-based stablecoin protocol Beanstalk Farms lost all of its $182 million collateral from a security breach caused by two sinister governance proposals and a flash loan attack.

The market for Beanstalk’s BEAN stablecoin collapsed as a result of the attack. The token was down 86% from its $1 peg, according to CoinGecko.

The problem for the protocol was seeded by suspicious governance proposals BIP-18 and BIP-19 issued on April 16 by the exploiter that asked for the protocol to donate funds to Ukraine.

However, those proposals had a malicious rider attached to them which ultimately created the sinkhole of funds from the protocol, according to smart contract auditor BlockSec.

This latest security breach of a decentralized finance (DeFi) protocol took place at 12:24 pm GMT. At that time, the exploiter took out $1 billion in flash loans from the AAVE (AAVE) protocol denominated in DAI (DAI), USD Coin (USDC), and Tether (USDT) stablecoins.

They used these funds to accumulate enough assets to take over 67% of the protocol’s governance and approve their own proposals.

A flash loan must be executed and repaid within a single block and usually calls on several smart contracts at once to complete. Flash loans have been used in the past to perform hacks or security exploits of other protocols. Beanstalk Farms is a decentralized algorithmic stablecoin issuing platform on Ethereum.

This case was technically not a hack as the smart contracts and governance procedures functioned as designed. Flaws in their design were exploited, which project spokesperson ‘Publius’ acknowledged in a meeting on April 18th when he said: It’s unfortunate that the same governance procedure that put beanstalk in a position to succeed was ultimately its undoing.