Ola Finance Hack

TOTAL LOST $4.7M
Medium Reentrancy fuse

What happened

The attacker's address:

https://explorer.fuse.io/address/0x371D7C9e…D63d75/transactions

The example transaction behind the exploit:

https://explorer.fuse.io/tx/0x1b3e06b6…b1dc90/token-transfers

The hack is made possible by the incompatibility between the Compound fork and ERC677/ERC777-based tokens, which have the built-in callback functions exploited to allow for reentry in doTransferOut() function and draining of the loan pool.

The attacker was initially funded by Tornado in Ethereum:

https://etherscan.io/tx/0x98c46fc9…a24efb

After the exploit execution, funds were delivered back into Ethereum and transferred to the following wallet:

https://etherscan.io/address/0xbcdb800d…118f42

Case & protocol details

Classification Smart Contract Language / Borrowing and Lending / Reentrancy
Protocol Type Exploit/Other
Smart Contract Language Solidity
Official Website ola.finance/
Protocol Twitter/X @ola_finance

Evidence & learning

Attack pattern

Compare incidents →
Reentrancy

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

GemPad $2.0M
Minterest $1.5M
Revest Finance $2.0M
Lendf.me $25.2M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes