LendHub Hack

Reported loss $6.0M
Heco
Collateral Offboarding Mistake

What happened

On January 12, 2023, an attacker drained about $6 million from LendHub, a Compound-style lending protocol on Huobi Eco Chain (HECO). LendHub had replaced its IBSV cToken market with a new version but never removed the old one. Both IBSV tokens stayed active, and both took their price from the new IBSV. The attacker minted and redeemed in the old market while borrowing against that position in the new market, and the two markets' separate accounting let them take assets out of the new market. LendHub's TVL fell from about $6 million to about $90,000.

The attacker was funded with 100 ETH from Tornado Cash on Ethereum late on January 11, then bridged HT and USDT to HECO. After the attack they moved funds to Ethereum and Optimism, sent 1,100 ETH to Tornado Cash on January 13, and deposited another 2,415.4 ETH there on February 26, 2023.

**On-chain reference**

- Attacker address (HECO): 0x9d0163e76bbcf776001e639d65f573949a53ab03

How it happened

  1. The attacker got 100 ETH from Tornado Cash on Ethereum, swapped part of it for HT and USDT, and bridged to HECO.
  2. Through an attack contract, they deposited HBSV into the old, deprecated IBSV market and received old IBSV cTokens, which were priced like the new IBSV.
  3. They used that position to borrow assets from the new market, including about 2,106 HDOT according to CertiK.
  4. They redeemed through the old market and repeated the cycle, pulling roughly $6 million out of the new market.
  5. The proceeds were bridged to Ethereum and Optimism, and part of them went into Tornado Cash.

Protocol details

Classification Protocol Logic / Token & Share Accounting / Borrowing and Lending
Protocol Type Lending
Affected asset / contract LHT
Implementation language Solidity
Protocol links Website @LendHubDefi

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes