Hundred Finance Hack

TOTAL LOST $6.2M
Medium Flash Loan Attacks gnosis chain

What happened

Quick Summary

Exploitation of reentrancy vulnerability in xDAI token's architecture allows attackers to borrow assets significantly more valuable than the provided collateral.

Details of the Exploit

The attacker exploited the xDAI token's architecture which includes the function callAfterTransfer(), creating a reentrancy vulnerability. By using flash loans as collateral, they were able to layer multiple borrow functions within one another to increase the borrowed amount before the protocol could update the debt balance. This approach was repeated and resulted in the borrowing of assets that were significantly more valuable than the collateral provided.

Block Data Reference

The attacker's address:

https://blockscout.com/xdai/mainnet/address/0xD041Ad9a…79E358/transactions

The stolen funds were bridged to Ethereum and deposited into Tornado Cash mixer:

https://etherscan.io/txs?a=0xd041ad9a…79e358

Case & protocol details

Classification Ecosystem / Borrowing and Lending / Reentrancy
Protocol Type Lending
Affected asset / contract HND
Smart Contract Language Solidity
Official Website hundred.finance/
Protocol Twitter/X @HundredFinance

Security review history

Evidence & learning

Attack pattern

Compare incidents →
Flash Loan Attacks Reentrancy

Proof of concept

1 available

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Sovryn $1.1M
Agave $5.5M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes