What happened
On July 28, 2022, an attacker used a roughly $10 million Solend flash loan to exploit Nirvana Finance's ANA pricing and extract about $3.5 million from the Solana protocol. The attacker bought ANA at its initial low price, then resold it to Nirvana after the protocol updated ANA's price upward. TRM Labs reported that about $2.6 million in stolen cryptocurrency was returned to Nirvana on June 5, 2024 following the criminal case against attacker Shakeeb Ahmed.
How it happened
- The attacker borrowed approximately $10.25 million in USDC through a Solend flash loan.
- They used the loaned funds to purchase ANA while exploiting the protocol's ability to sell ANA at its initial low price.
- Once the purchase made ANA's price update upward, they sold ANA back to Nirvana at the higher price and withdrew stablecoins from the treasury.
- The flash loan was repaid, while the remaining proceeds were moved from Solana to Ethereum through Wormhole.
Protocol details
Classification
Ecosystem / Oracle Manipulation / Stablecoin
Protocol Type
CDP
Affected asset / contract
ANA
Implementation language
Rust
Protocol links
Website
@nirvana_fi
Evidence
- report @osec_io incident report twitter.com
- analysis Web Archive web.archive.org
- analysis Website reference coindesk.com
- analysis Website reference yahoo.com
- analysis Website reference theblock.co
- analysis Website reference thelayer.xyz
- analysis Website reference coinjournal.net
- analysis DeFiLlama defillama.com
- analysis Nirvana Finance Incident Analysis certik.com
- analysis Funds Returned to DeFi Exchange Nirvana in First Ever DeFi Hack Prosecution trmlabs.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
