DeFi Lender Sonne Finance Suffers $20M Hack, Halts Activities on Optimism Network

Sonne Finance, a decentralized finance (DeFi) protocol enabling users to lend and borrow cryptocurrencies, has become the latest victim to bad actors as it suffers a nearly $20 million hack today. Investigations to identify the attacker and retrieve the funds are underway. The protocol’s native crypto (SONNE) took a big hit after the exploit.

Sonne Finance Loses $20M

According to a post-mortem report from the DeFi lender’s team, the hacker used the “known donation attack” to conduct the exploit. It entailed donating large amounts of cryptocurrencies into Sonne Finance’s Optimism-based protocol to manipulate the exchange rate between two tokens.

A recent community proposal endorsed the addition of token markets for Velodrome Finance’s VELO crypto asset to the Sonne Finance platform. A two-day timelock was implemented to this effect. The hacker capitalized on this timelock to execute four transactions that included market creations and adding collateral factors. This chain of activities achieved its goal; tricking the DeFi lender into believing that the available collateral was sufficient.

After the two-day timelock, the hacker escaped with nearly $20 million worth of crypto assets. These assets included VELO, ETH, and USDC.

The team acknowledged that the exploit could have been worse if Seal contributors had not used $100 worth of VELO to save $6.5 million from being stolen.

Upon identifying the attack 25 minutes after its occurrence, Sonne Finance halted activities on the Optimism network. The project’s team is ready to offer a bounty to the attacker if they readily return the stolen funds.

Meanwhile, the SONNE token has tanked about 60% following the attack. At the time of writing, the asset traded at $0.0283.

Source: CoinMarketCap

More Hacks Storm the Crypto Industry

Sonne Finance’s exploit is one among several other protocols that have suffered security attacks that caused fund loss. Earlier today, a Bitcoin-based DeFi protocol ALEX lost $4.3 million to bad actors. Although the project’s team has identified the hacker’s identity, a fund retrieval has yet to occur at the time of writing.