Binance Smart Chain DeFi project Belt Finance hacked for $ 6.2 million to a flash loan attack

By Selena On May 30, 2021

On May 30, another project on Binance Smart Chain (BSC) was hacked, which is Belt Finance. The method is not strange, that is to take advantage of the flash loan tool. The total loss this time is estimated at $6.2 million in BUSD in just 8 transactions.

Binance Smart Chain DeFi project Belt Finance hacked for $ 6.2 million to a flash loan attack

Projects built on top of Binance Smart Chain have recently been repeatedly targeted by attackers. After Pancake Bunny, the most recent is BurgerSwap or Venus. And this time, the flash loan attack on BSC called Belt Finance.

Belt Finance is a platform that provides AMM – Automated Market Making (automatic market) feature for stablecoins and equivalent assets on Binance Smart Chain. It is known that Belt Finance is one of the largest IFO projects on Pancake Swap with extremely fast development. As of now, it has hit the $700 million TVL mark in just 48 hours.

Reportedly, there were 8 transactions that took place to steal about $6.2 million from Belt Finance:

2/8

Each transaction looked like this:

1) Used 8 flash loans on $385M BUSD from PancakeSwap

2) Deposited 10M BUSD in bEllipsisBUSD strategy (only for the first transaction, where it was the ‘Most Insufficient Strategy’) pic.twitter.com/JRgDSgub6F

— Igor Igamberdiev (@FrankResearcher) May 29, 2021

Accordingly, the Belt Finance team was also quite quick, announcing to all users on Twitter as follows:

Source: Belt Finance Twitter

At the moment, the BELT price is down around 25%, trading around $32.82. It is known that beltBUSD price depends on the total balance of all vaults. Moreover, the fact that hackers continuously deposit BUSD, swap to USDT then withdraw BUSD, swap to USDT, and then continue this loop will not make a profit because the number of assets does not change.

According to Igamberdiev, all of the stolen BUSD was converted to 2680 anyETH ($6 million) via 1inch v3, and a part was withdrawn to Ethereum. Besides, 1,463 ETH is still in the process of completing the move away from the cross-chain bridge.

1. Work with your audit companies to do another health check. If you are forked projects, please double and triple check your changes from original version.

— Binance Smart Chain (@BinanceChain) May 30, 2021

At the present time, the BSC side has also spoken out. They claim that hackers are targeting Binance Smart Chain, urging everyone to act quickly for all dApps. The first is to work with familiar auditing firms to perform a general check. Then, quickly apply the necessary risk control measures to proactively monitor any anomalies and halt the process if anomalies do occur.

Besides, projects are also recommended to have a backup plan for the worst-case scenario if it really happens.

DeFi is growing in popularity and has become a target for profiteering attacks. Not only Belt Finance this time, but many projects like those on Binance Smart Chain have also been hacked before. Typical is the PancakeBunny attack last week with more than $ 200 million being withdrawn from the platform. Besides the BurgerSwap incident, the JulSwap project is also another victim of hackers. The project confirmed the cause of the sharp drop in the JUL price as a flash-loan attack. Over the weekend, another Binance Smart Chain project called Bogged Finance also suffered an attack with a total loss of $3 million.

Read more: