Secured Finance Lending Hack
What happened
Secured Finance runs an on-chain order book for fixed-rate lending and borrowing of digital assets. On September 5, 2026, attackers drained its Ethereum lending vault by manipulating the price the protocol used to value lend positions as collateral. That price, from getMarketUnitPrice(), was simply the ratio of amounts filled in the current block, so a flash-loan-funded trader who filled orders against themselves could set it.
The largest single drain took about 0.9 WBTC (about $72,000) from the TokenVault. It was executed by the MEV searcher known as "coffeebabe" (0xc0ffeebabe...), which replayed the strategy after the original attacker's transaction reverted out of gas. Later copycat bots made two smaller USDC drains.
The reported loss across all of these transactions is about $104,000.
How it happened
- The attacker flash-borrowed 0.91 WBTC from Balancer and deposited it into the Secured Finance
TokenVault. - It placed a lend order at a very low unit price (3 out of 10000), which recorded a huge future value for a tiny principal. It then placed small orders to satisfy the per-block volume check that marks a block's price as reliable.
- A second attacker-controlled account deposited 0.9 WBTC and posted a lend order at par (10000), and the main contract borrowed against it at par. Because both legs were filled in the same block,
getMarketUnitPrice()read the block's fill ratio as par. - The collateral check used that same-block price, so the cheap lend position was valued as fully backed. The attacker placed more borrow orders and called
withdrawon the vault until its WBTC was gone. - It repaid the fee-free Balancer loan and kept about 0.9 WBTC.
Protocol details
Security review history
- Quantstamp View report
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
