Hundred Finance Hack

TOTAL LOST $7.4M
Medium Flash Loan Attacks optimism

What happened

Quick Summary

Hundred Finance was hacked due to a price manipulation attack, resulting in 6,701,157 $USD worth of cryptocurrency being drained from various pools.

Details of the Exploit

Hundred Finance is a multichain lending protocol. The protocol experienced a hack due to a price manipulation attack on the Optimism layer-two chain. The attacker deployed malicious smart contract with unverified source code, and then donated 200 $WBTC to inflate hWBTC's exchange rate so that even a tiny amount (2 wei) of $hWBTC could drain current lending pools.

The attacker then borrows 500 $WBTC from Aave and deposited into the pool and borrowed funds from all pools because of the inflated price of $hWBTC. Consequently, 500 $WTBC was redeemed back for nothing, which caused the attacker contract being liquidated. This resulted in 6,701,157 $USD worth of cryptocurrency being drained from their lending pools.

The hacker bridged over 1,034 $ETH valued at 2,180,000 $USD on the day of transfer along with other cryptocurrencies such as USDC and USDT via Multichain and swapped them for various tokens including DAI, FRAX, PAXG among others. 919,224 $USD worth of $sUSD and $SNX remains at the attackers original address at the moment.

Block Data Reference

Attacker address:

https://optimistic.etherscan.io/address/0x155da45d…e67528

Malicious transactions:

https://optimistic.etherscan.io/tx/0x6e9ebcde…04f451

https://optimistic.etherscan.io//tx/0x15096dc6…ceea93

Malicious contracts:

https://optimistic.etherscan.io/address/0x978d0ce2…754982

https://optimistic.etherscan.io/address/0x284abd14…5c9aac

https://optimistic.etherscan.io/address/0xd340f220…1e702b

Case & protocol details

Classification Protocol Logic / Borrowing and Lending / Token & Share Accounting
Protocol Type Lending
Smart Contract Language Solidity
Official Website hundred.finance
Protocol Twitter/X @HundredFinance

Security review history

Evidence & learning

Attack pattern

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Proof of concept

1 available

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes