Abracadabra Finance drained of estimated $6.4 million in apparent security attack

DeFi protocol Abracadabra Finance reportedly suffered a significant security attack. Security analysts at Blocksec and Peckshield estimated that the protocol appears to have been drained of over $6.4 million.

Blocksec said the attackers targeted the project’s smart contract, taking advantage of a rounding issue that resulted in what is known as a “precision loss.” The firm estimated that over $29 million in assets remained in the affected contract at the time of writing.

“Our analysis indicates that the root cause is due to precision loss, which leads to the bypassing of the insolvency check. As a result, the attacker could borrow a large number of MIM tokens with less collateral,” Blocksec’s chief technology officer Lei Wu said.

Abracadabra Finance, known for its DeFi lending and borrowing tools, allows users to deposit various cryptocurrencies as collateral to borrow a stablecoin named Magic Internet Money (MIM).

The incident caused the MIM stablecoin to briefly depeg to below $0.7 before recovering to $0.96, according to The Block’s price page.

The Abracadabra Finance team issued a statement. “We are aware of an exploit involving certain cauldrons on Ethereum. Our engineering team is triaging and investigating the situation,” it said. The project added its DAO treasury “will be buying back MIM from the market” and burning them as a step to recuperate from the incident and the associated MIM depeg.

Abracadabra Finance was co-founded by Daniele Sesta, known for his involvement in projects like Wonderland Money and Popsicle Finance.