Hifi Finance governance attacked via Tornado Cash-funded address; attacker minted 25M HIFI tokens and drained ~$1M in user collateral including RWA tokens.
Security & Exploits ·
An address funded through Tornado Cash executed a governance takeover of Hifi Finance by casting four last-minute votes, according to a report on the incident. The attacker minted 25 million new HIFI governance tokens and transferred approximately $1 million in user collateral, with most held in an RWA token. The hostile proposal passed with 2,945,598 votes in favor to zero against, exceeding the quorum requirement of 2,839,677.
The exploit targeted a vulnerability in how the BalanceSheet contract defined "idle" collateral. The upgrade swapped the contract's code to send all existing collateral to a hardcoded address controlled by the attacker. The new implementation initialized a storage tracker at zero for all assets, causing all collateral deposited before the upgrade to be classified as idle and subject to harvesting. Nearly all of the drained funds—about $1.02 million—consisted of HC1, an RWA token securing the protocol's single active loan. The same attack group had twice previously attempted similar exploits through proposals 18 and 20, both of which were defeated.
Once executed, the proposal rendered the protocol's only outstanding loan unsecured on-chain, as the collateral backing it would no longer be available for liquidation. The attacker's voting power from the newly minted tokens would also enable future proposals to manipulate the price oracle and mint unlimited HIFI, with losses falling primarily on existing HIFI holders and future depositors. Defenders faced a narrow three-hour window to create a counterproposal before the attack could be executed.