Mochi DeFi Contract Multiple Transactions Suspicious Attack

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Mochi DeFi Logo/Homepage

MochiFi, a DeFi platform that enabled users to use digital assets and NFTs as collateral to borrow its native stablecoin USDM, suffered a security breach due to a vulnerability in its smart contract. This led to a suspicious transaction resulting in a loss of approximately $49,000 USD, as reported by TenArmor. Following the incident, the project appears to have gone inactive, with no public efforts from the team to recover lost funds or compensate affected users, and third-party sources have confirmed the lack of ongoing activity or resolution.

About Mochi DeFi

MochiFi is a decentralized finance (DeFi) platform that allows users to utilize emerging digital assets and NFTs as collateral. The core offering revolves around enabling users to maintain exposure to the long-term value of their digital holdings while gaining liquidity through borrowing USDM, a stablecoin native to the Mochi ecosystem. Mochi provides various tools, such as vaults and asset pools, to help users manage and maximize the utility of their digital assets.

The platform supports a variety of asset tokens that can be deposited into vaults, contributing to the system’s total value locked (TVL). Users can then borrow against these deposits, accessing USDM liquidity. The system also features real-time stats like circulating USDM, vault TVL, and the system ratio, offering transparency and insight into the protocol’s health and performance. Auctions and lab features are available to experiment with or participate in new financial mechanisms within the Mochi ecosystem.

MochiFi emphasizes community engagement and transparency, offering multiple touchpoints such as Discord, Twitter, Telegram, a forum, and documentation for user support. It is integrated with major DeFi tracking platforms like Defi Llama and Defi Pulse and adheres to Ethereum standards like EIP-1559. By entering the app, users agree to the terms of service and can begin leveraging their assets for borrowing or other DeFi operations through a clean, wallet-connected interface.

The Reality

Unfortunately, the Mochi DeFi smart contract was vulnerable.

What Happened

MochiFi, a DeFi platform for borrowing against digital assets, suffered a smart contract exploit resulting in a $49,000 loss.

Key Event Timeline - Mochi DeFi Contract Multiple Transactions Suspicious Attack

Date	Event	Description
December 14th, 2021 10:25:00 AM MST	Last Post From Mochi DeFi	The last post on Twitter/X from Mochi DeFi is posted.
April 6th, 2025 4:53:59 AM MDT	Attack Transaction 1	The first attack transaction on ethereum.
April 6th, 2025 4:57:59 AM MDT	Attack Transaction 2	The second attack transaction on ethereum.
April 6th, 2025 5:15:23 AM MDT	Attack Transaction 3	The third attack transaction on ethereum.
April 6th, 2025 7:31:00 AM MDT	BlockSecTeam Posting Alerta	BlockSecTeam posts an alert about the attack, which features attack transaction 2.
April 6th, 2025 9:37:00 AM MDT	TenArmor Posting Alert	TenArmor posts an alert with details and a list of transactions involved in the attack.

Technical Details

The transaction is described as a "suspicious attack".

Total Amount Lost

TenArmor reports that the amount lost was approximately $49k USD.

The total amount lost has been estimated at $49,000 USD.

Immediate Reactions

The Mochi DeFi project appears to be inactive. The situation was reported on by other third parties.

Ultimate Outcome

It does not seem like anyone involved in Mochi DeFi is going to be pursuing a recovery for affected users.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

There doesn't seem to be anything ongoing in this case.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.