BiFi Hack

On October 19, 2026, decentralized lending platform BiFi was exploited for approximately $165,600 USD (165.6K USDT) due to an interest rate calculation logic flaw triggered after a 36-day period of market inactivity. The attack was successfully front-run and executed by white-hat/MEV bot c0ffeebabe.eth.

The vulnerability existed within BiFi's USDT market contract (0x808c...), specifically inside TokenHandler._checkFirstAction. Because the market had been idle for approximately 264,000 blocks (~36 days), _checkFirstAction recorded this block gap as inactiveActionDelta and froze actionEXR once per block. However, subsequent actions within the same block repeatedly re-ran interestModel.getInterestAmount, calculating globalEXR = actionEXR × (1 + rate × 264K).

Because rate was calculated dynamically based on live deposit/borrow utilization, an attacker could manipulate market utilization and apply the full 36-day accrued interest rate on every single contract call within that block. The original attacker deployed the exploit contract at block 262,102,55. One block later (block 262,102,56), MEV bot c0ffeebabe.eth front-ran the execution, taking a 40.5M USDT flash loan from Morpho, depositing it in tranches, and borrowing 30M USDT to spike utilization.

Through a repeated repay/withdraw loop, the bot extracted the artificially inflated deposit interest, netting 165.6K USDT (swapped to WETH).

Original Attacker Deployment Tx: 0x15b47e2c…77a034 (Block 262,102,55)

Front-Run Execution Tx: 0x756c6805…d6ad14 (Block 262,102,56)

Original Attacker Address: 0x7c78a049…6ec4c6

MEV / Front-Runner Address: 0xc0ffeeba…f29671 (c0ffeebabe.eth)

Victim Contract: 0x808c3ba9…67a9e3