What happened
Defrost Finance experienced attacks against both V2 and V1 in December 2022. Analysis estimated roughly $173,000 lost from V2 and about $12 million from V1. Defrost later reported recovering V1 assets and earmarked 12,850,277 DAI.e for refunds.
The incidents used different paths: V2's reported flash-loan/reentrancy weakness and V1's privileged collateral and oracle controls. Whether V1 access involved stolen credentials or an insider remained disputed. A refund plan alone does not prove every user received payment.
How it happened
- A flash loan supported manipulation of the LSWUSDC price in V2.
- In the V1 incident, privileged access allowed addition of fake collateral and a malicious oracle.
- The altered setup enabled H2O issuance and extraction of real stablecoin assets.
- Defrost's January refund plan described converting recovered ETH to DAI and transferring it to Avalanche for distribution.
Protocol details
Funds Recovery
Recovered
$12.0M
Net Loss
$0
Evidence
Proof of concept
1 available- Code Defrost Reentrancy
Sources
- report Twitter/X Alert twitter.com
- report Report de.fi
- report @PeckShieldAlert incident report twitter.com
- report @peckshield incident report twitter.com
- report UPDATED: Details of the Defrost Finance Refund Plan medium.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Explained: The Defrost Hack (December 2022) halborn.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
