Eleven Finance Hack

Reported loss $4.5M
BNB Chain
Flashloan Burn Function Exploit

What happened

Eleven Finance's June 2021 exploit drained its NRV-related vaults on BNB Chain. An emergency withdrawal returned underlying assets without burning the corresponding shares, enabling a second withdrawal. Eleven later said all exploited funds were recovered and returned to users.

Technical root cause

emergencyBurn transferred assets without burning the shares that represented the depositor's claim. Those stale shares remained redeemable through withdrawAll, creating a double-withdrawal path.

How it happened

  1. The attacker used a PancakeSwap flash swap to obtain assets and create liquidity-provider tokens.
  2. They deposited those tokens through ElevenNeverSellVault and received vault shares.
  3. emergencyBurn returned the underlying tokens but left the shares intact.
  4. withdrawAll redeemed those same shares for another withdrawal. The attacker repeated the pattern against other vaults.

Protocol details

Classification Ecosystem / Yield Aggregator / Protocol Logic
Protocol Type Exploit/Other
Affected asset / contract ELE
Implementation language Solidity
Protocol links Website @ElevenFinance

Funds Recovery

93.3%

Recovered

$4.2M

Net Loss

$301,500

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes