Raft Hack

TOTAL LOST $3.3M
Medium Infinite Mint and Dump ethereum

What happened

Quick Summary

Raft lending platform was exploited due to a precision calculation issue, resulting in a loss of 3,304,406 USD worth 1575.67 ETH.

Details of the Exploit

Raft is a lending and borrowing platform that runs R stablecoin. On November 10, 2023, a precision calculation issue was exploited, allowing the attacker to mint ~$6.7 million unbacked R and sell R, causing R's depeg. The attacker borrowed 6,000 cbETH from AAVE via a flash loan and exploited the divUp function's behavior to mint extra share tokens.

They then redeemed a nominal amount of rcbETH-c for a significant quantity of cbETH and borrowed substantial amounts of R. The attacker swapped the minted R for 1575 ETH, but burned 1,570 ETH, resulting in a loss of 3,304,406 USD worth 1575.67 ETH for the project.

Block Data Reference

Attacker Address:

https://etherscan.io/address/0xc1f2b71A…d439fA

Malicious Transaction:

https://etherscan.io/tx/0xfeedbf51…75ace7

Malicious Contract Address:

https://etherscan.io/address/0x0A334012…315ef8

TornadoCash Funding Transaction:

https://etherscan.io/tx/0x86e9ee13…7ea50e

Case & protocol details

Classification Protocol Logic / Stablecoin,Borrowing and Lending / Token & Share Accounting
Protocol Type CDP
Affected asset / contract RAFT
Smart Contract Language Solidity
Official Website www.raft.fi/
Protocol Twitter/X @raft_fi

Security review history

Evidence & learning

Proof of concept

1 available

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Saga $7.0M
Holograph $14.4M
Paid Network $27.4M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes