At least $25M lost across three incidents in busy day for crypto hackers

Sonne uses forked code from Compound, one of the first decentralized finance (DeFi) lending protocols. ‘Forking,’ or reusing, code from established projects is a common practice in DeFi, as it’s often considered ‘battle tested’ and therefore safer than freshly written contracts.

Compound’s v2 code, however, contains a well-known vulnerability with new, empty markets. This introduces a potential rounding error that can be exploited to drain available borrow liquidity on the platform. Over the past year, the same hack has affected Onyx Protocol, Hundred Finance, and Midas Capital, totaling $10 million in losses.

Despite being aware of the issue, Sonne Finance’s post-mortem report explains that the hacker was able to create the markets “without us noticing,” due to the ‘permissionless’ nature of the functions on Optimism. Sonne’s other deployment, on Base, was not affected.

Although $20 million was lost, security researchers were able to save $6.5 million of remaining funds by depositing $100 worth of VELO tokens, making the exploit unworkable.

Suspicious transaction swipes $4.3M fom ALEXLab bridge

Hours before, audit firm Certik identified a ‘suspicious transaction’ in which $4.3 million was removed from the XLink bridge which connects the Bitcoin ‘layer two’ ALEXLab to the BNB Chain.