Agave Hack

TOTAL LOST $5.5M
Medium Flash Loan Attacks gnosis chain

What happened

The attacker's address:

https://blockscout.com/xdai/mainnet/address/0xD041Ad9a…79E358/transactions

The attacks were made possible due to the xDAI token's architecture, which includes the function callAfterTransfer(), which creates a reentrancy vulnerability.

Using flash loans as collateral, the attacker(s) layered multiple borrow functions within one another, increasing the amount borrowed before the protocol could update the debt balance. Repeating this approach resulted in borrowing assets that were significantly more valuable than the collateral provided.

Stolen funds were bridged to Ethereum and deposited into Tornado Cash mixer:

https://etherscan.io/txs?a=0xd041ad9a…79e358

Case & protocol details

Classification Ecosystem / Borrowing and Lending / Reentrancy
Protocol Type Lending
Affected asset / contract AGVE
Smart Contract Language Solidity
Official Website agave.finance/
Protocol Twitter/X @Agave_lending

Evidence & learning

Attack pattern

Compare incidents →
Flash Loan Attacks Reentrancy

Proof of concept

1 available

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Sovryn $1.1M
Hundred Finance $6.2M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes