ABRACADABRA MONEY

DESCRIPTION OF EVENTS

Abracadabra Money is an omnichain decentralized finance (DeFi) lending platform that enables users to mint Magic Internet Money (MIM), a USD-pegged stablecoin, by using interest-bearing tokens as collateral. The platform operates across multiple blockchains, including Ethereum, Arbitrum, Kava, and others, offering liquidity and borrowing opportunities in a decentralized ecosystem. With a focus on deep liquidity, overcollateralization, and seamless cross-chain functionality, Abracadabra aims to provide a robust and scalable solution for DeFi users. It has accumulated significant value, with $147.86M total value locked and $82.03M in fees generated, reflecting its widespread adoption and effectiveness in the market.

MIM, the platform’s native stablecoin, maintains its 1:1 peg to the US dollar through a backing of interest-bearing tokens, ensuring stability even in volatile market conditions. The platform also employs its governance token, SPELL, which allows holders to participate in platform decisions and shape its future direction. SPELL holders can stake their tokens to earn rewards, and a portion of the fees generated from cauldrons, the platform's core borrowing mechanism, is shared with the community. This incentive structure further strengthens the platform's decentralized nature and encourages active participation from its users.

In addition to its core lending and collateralized borrowing features, Abracadabra offers a variety of products such as MIM Pools, Farms, and staking options. The platform is designed to provide users with attractive yields and opportunities to earn rewards by providing liquidity and participating in governance. Abracadabra also features a Beam function for seamless cross-chain asset movement with a fixed fee structure. The DAO ecosystem allows users to engage with the community, contribute to decision-making, and benefit from community-curated analytics, fostering a collaborative environment aimed at continuous platform development.

Unfortunately, the deprecated V4 cauldron smart contracts had a vulnerability which allowed for a loan to be taken out with insufficient collateral.

Limited details are available publicly. It appears that the vulnerability affects only the V4 cauldrons, and allows an attacker to take out a loan without providing full collateral.

The swap features a total of $1.79M USDT and MIM_Spell, the abracadabra.money main account, also reported this figure. SlowMist estimated the losses as $1.8m USD.

The Abracadabra Money treasury bought back tokens in proportion to the sum which was lost to restore the protocol.

The incident was publicly acknowledged by the Abracadabra Money team. The treasury reportedly "identified and mitigated the vulnerability, confirmed no other cauldrons or users funds were at risk, and bought back from the Market the entirety of affected MIM, completely reversing the effect of the attack."

The amount was fully recovered as the DAO treasury has reportedly bought the full amount of affected MIM back from the market.

There appear to be ongoing efforts to trace the funds which were taken by the exploiter. Even though they used Tornado Cash, they withdrew from it quickly, and it was trivial to connect the deposits and withdrawals together.

Abracadabra Money, an omnichain DeFi lending platform, experienced a vulnerability in its deprecated V4 cauldron smart contracts, allowing an attacker to take out a loan with insufficient collateral. This exploit resulted in an estimated loss of $1.8 million, affecting MIM and USDT. The platform's team quickly identified and mitigated the issue, confirming that no other cauldrons or user funds were at risk. The Abracadabra treasury bought back the affected MIM tokens from the market to restore the protocol, fully reversing the impact of the attack. Ongoing efforts are being made to trace the stolen funds, despite the attacker using Tornado Cash to obfuscate transactions.

MIM_Spell - "On Saturday, a security vulnerability was discovered that affected some V4 deprecated cauldrons on Ethereum mainnet. During the attack, 1.79m MIM were minted by the attacker. Shortly after, the DAO Treasury identified and mitigated the vulnerability, confirmed no other cauldrons or users funds were at risk, and bought back from the Market the entirety of affected MIM, completely reversing the effect of the attack." - Twitter/X (Oct 28)
Attack Transaction On Abracadabra.Money - EtherScan (Oct 28)
m13_digital - "Abracadabra Money was exploited again, this is the third major exploit on the DeFi lending protocol. The attacker exploited vulnerabilities in Abracadabras cauldrons, draining ~$1.7M in $MIM and swapping it for ~395 $ETH." - Twitter/X (Oct 28)
lxm697 - "Abracadabra, a defi lending protocol, was exploited for $1.8M. The attacker abused a smart contract flaw and borrowed 1.79M tokens without providing full collateral. The attacker then swapped the tokens and moved them through mixers. This is Abracadabra's third major hack." - Twitter/X (Oct 28)
Abracadabra Money Twitter/X Account (Oct 28)
Abracadabra Money Homepage (Apr 16)

More case studies

BNB Chain Twitter/X Account
Hack Phishing Meme Coin Launch

Watt Protocol Twitter/X
Takeover Solana Tokens Launched