How much was lost in the Midas Capital hack?

The Midas Capital hack resulted in $660K in losses on January 17, 2023.

What attack technique was used in the Midas Capital exploit?

The Midas Capital exploit utilized Flashloan Reentrancy Attack / Flash Loan Attack. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Midas Capital Hack

TOTAL LOST $660K

Low Jan 17, 2023 Flashloan Reentrancy Attack / Flash Loan Attack polygon

Affected Chain polygon Incident surface

Recovered - No recovery reported

All-Time Rank #937 By amount stolen

Auditors 1 Prior security audit

Incident Overview

Quick Summary

Midas Capital protocol was exploited via a flashloan attack. The attacker stole worth around $650k USD.

Details of the Exploit

Midas Capital protocol smart contract was exploited using multiple patterns such as flashloan, reentrancy, and code logic issues. Flashloan, taken, from the balancerV2 pool was used to perform an attack on the Midas pool. The logic of calculation of a position's collateral was exploited and gave an opportunity to the attacker to gain about 660k MATIC of profit.

After that MATIC tokens were transferred to multiple addresses on Polygon network.

Block Data Reference

Exploit TX:

https://polygonscan.com/tx/0x00534902…0a2c2f

Exploiter addresses:

https://polygonscan.com/address/0x1863b747…d08611

https://polygonscan.com/address/0xe53955d2…e359be

https://polygonscan.com/address/0x123bb33d…293eb8

https://polygonscan.com/address/0x7d27bc40…1d6c40

https://polygonscan.com/address/0xb6ac8cbd…33f429

https://polygonscan.com/address/0x49605afe…8e049c

https://polygonscan.com/address/0x8dded7da…c344ac

https://polygonscan.com/address/0x5ad4238b…d14a0d

https://polygonscan.com/address/0x65281cad…5a72ec

https://polygonscan.com/address/0x7de62e82…7f5922

https://polygonscan.com/address/0x62cc8544…957a8e

https://polygonscan.com/address/0x1395d3d5…8317ff

This is classified as a Flash Loans Attacks, Reentrancy . Compare similar hacks →

Incident Report

Protocol / Project Midas Capital

Date of Incident January 17, 2023

Affected Chain(s) polygon

Attack Technique Flashloan Reentrancy Attack / Flash Loan Attack

Classification Ecosystem / Borrowing and Lending

Primary Source View Post-Mortem

Protocol Information

Protocol Type Lending

Smart Contract Language Solidity

Official Website app.midascapital.xyz/

Protocol Twitter/X @MidasCapitalxyz

Team Anonymous

Source Code Unverified

Market Context at Time of Hack

Token Categories

BNB Chain Ecosystem

Protocol Links

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of flashloan reentrancy attack / flash loan attack and Solidity and EVM internals

Capital Required Flash loan capital (borrowed atomically, zero upfront cost)

On-Chain Access Ability to interact with polygon smart contracts and deploy a custom exploit contract

Protocol Analysis Identification of the exploitable vulnerability in Midas Capital's contract logic - root cause: ecosystem / borrowing and lending

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Yes — skilled auditors routinely flag Flashloan Reentrancy Attack / Flash Loan Attack vulnerabilities in code review

Audited by Audit Report 1 — still lost $660K. Prior audits don't guarantee safety, especially after post-audit code changes.

If you're auditing a protocol with similar architecture to Midas Capital, these are the critical security checks that could have prevented this incident (January 2023).

Verify all logic paths related to Flashloan Reentrancy Attack / Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
Check that all state-changing functions follow the Checks-Effects-Interactions (CEI) pattern to prevent reentrancy and logic ordering bugs
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Security Audit History

Audit Report 1 Report

Related Attack Classes

The technique used in this hack maps to these vulnerability classes in our security curriculum:

See all Flash Loans Attacks examples →

Flash Loans Attacks Reentrancy

Sources & References

01
Source 1 https://rekt.news/midas-capital-rekt/
02
Reference https://twitter.com/CertiKAlert/status/1614711570528878597
03
Reference https://twitter.com/BlockSecTeam/status/1614864084956254209

Threat Assessment

Severity Level

LOW

Attack Vector Flashloan Reentrancy Attack / Flash Loan Attack
Root Cause Ecosystem / Borrowing and Lending
Year 2023

Learn to Prevent the Next Midas Capital

The Midas Capital hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library