Algorand-Based DeFi Platform ‘Tinyman’ Exploited for $3 Million

The DeFi space has already had its first breach this year as Tinyman, an Algorand-based decentralised trading platform, was hacked and drained for roughly US$3 million.

On January 1, Tinyman announced via its Twitter account that its platform had been compromised, saying it had pulled the remaining liquidity from Tinyman on the TINY token. The platform has advised its community to withdraw their funds as the exploit is ongoing:

How the Breach Took Place

As per the investigation, the attackers managed to exploit various vulnerabilities in the platform’s smart contracts, giving them access to various liquidity pools. They started interacting with the targeted pools and swapped a portion of their funds to acquire ASAs, causing price instability in the following hours.

The attacker exploits an unknown bug in the burning of pool tokens and receives two of the same assets instead of two different assets. This worked in favour of the attacker since the gobtc asset was significantly more valuable than ALGO, which they immediately swapped against ALGO to receive more funds to continue their attack.

Advertisement

Tinyman blog post

The team behind Tinyman said that they were unable to block ongoing transactions on the blockchain as the contracts are permissionless. The first step, however, was to pull all of the liquidity from all Tinyman contracts and return it once the platform is clear of any attacks.

Another Day, Another Hack

DeFi protocols are always at risk of suffering smart contract exploitations on their platforms, or similar attacks such as security breaches or DoS (Denial of Service). As expected, each platform’s token drops massively after the liquidity pools are drained, leaving a wide cut on investors’ pockets.

In December 2021, the crypto community saw DeFi marketplace MonoX hacked for US$31 million, one of the largest hacks in that month. Two months earlier, Indexed Finance suffered its first hack, with US$16 million drained out of their two pools.