Stablecoin Heist: Raft Protocol Loses Millions in Cyber Theft

A recent cyberattack on Raft, a protocol for a stablecoin pegged to the U.S. dollar, resulted in the theft of $6.7 million. This incident occurred despite the protocol undergoing multiple security checks by renowned blockchain security firms. On November 13, Raft revealed details of the attack in a detailed analysis.

Just a few days before the breach, an unidentified individual managed to acquire 6,000 Coinbase-wrapped staked Ether (cbETH) from the decentralized finance platform Aave. This individual then exploited a flaw in Raft's system to create 6.7 million of Raft's stablecoins, known as R tokens. These tokens were subsequently exchanged for $3.6 million on decentralized exchange platforms like Balancer and Uniswap, causing Raft's stablecoin to lose its value against the dollar.

Root of the Problem

The core issue stemmed from a miscalculation in the minting process of share tokens, as identified in Raft's report. This miscalculation allowed the hacker to receive additional share tokens, which they used to inflate the value of their holdings. The exploited smart contracts had previously been examined by Trail of Bits and Hats Finance, two leading blockchain security firms. However, these audits failed to identify the vulnerabilities that led to the breach.

In response to this security breach, Raft has paused all its smart contract operations. They have also reported the incident to law enforcement and are collaborating with centralized exchanges to trace the stolen funds. Users who had minted R tokens can still repay their positions and reclaim their collateral.

This incident is not the first of its kind in the world of decentralized stablecoins. In December 2022, a similar exploit occurred with the HAY stablecoin, which lost its peg against the dollar after a hacker minted 16 million HAY without adequate collateral. The HAY stablecoin later regained its value, partly due to its protocol demanding a collateralization ratio of 152% at the time of the exploit as a risk management measure.

Such incidents highlight the ongoing challenges and risks associated with decentralized finance, especially concerning the security of smart contracts and the need for more robust auditing processes.