\n
![](\"https:\/\/images.cointelegraph.com\/images\/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjItMDMvMDUwMjIxNzgtMzkxMy00N2EwLTgzYWQtMWE0NTg5NWMxZGFkLmpwZw==.jpg\")
<\/p>\n
\n<\/p>\n
A hacker has made off<\/a> with approximately $11 million in wrapped ETH (wETH), wrapped BTC (wBTC), Chainlink (LINK<\/a>), USD Coin (USDC<\/a>), Gnosis (GNO) and wrapped XDAI (wxDAI) after using a \u201cre-entrancy\u201d attack on decentralized finance (DeFi) lending protocol applications Agave and Hundred Finance.<\/p>\n The attack comes within 24 hours of the news breaking of the Deus Finance exploit, where hackers stole over $3 million in Dai (DAI) and Ether (ETH<\/a>) from the lending contract platform.<\/p>\n Agave token AGVE dropped by 20% following the attack, according to data from CoinGecko. Hundred Finances token HND fell 3.5% after it announced the exploit. However, it\u2019s since recovered to hit a 24-hour high.<\/p>\n \u201cAgave is currently investigating an exploit on the agave finance protocol,\u201d Agave tweeted<\/a> on Tuesday. \u201cWe will update you as soon as we know more.\u201d It noted that contracts have been paused until the situation is resolved.<\/p>\n The Hundred Finance team also tweeted<\/a>\u00a0that it was exploited on the Gnosis chain and has paused its markets while pursuing investigations.<\/p>\n According to on-chain analysis, the address associated<\/a> with the attacker has sent over 2,100 ETH, worth over $5.5 million, to a crypto mixer in an attempt to launder the stolen tokens<\/a>.<\/p>\n Related:<\/em><\/strong>Deus Finance exploit: Hackers get away with $3M worth of DAI and Ether<\/em><\/strong><\/a><\/p>\n Solidity developer and creator of an NFT liquidity protocol application Shegen (@shegenerates), tweeted that she lost $225,000 in the exploit. Her investigations revealed the attack worked by exploiting a wETH contract function<\/a> on Gnosis Chain, allowing the attacker to continue borrowing crypto before the apps could calculate the debt preventing further borrowing.<\/p>\n The attacker ran this exploit, continually borrowing against the same collateral they were posting until the funds were drained from the protocols.<\/p>\n Shegen told Cointelegraph that while the smart contract on Agave is essentially the same as Aave, which secures $18.4B, \u201cevery security researcher has audited it,\u201d she said. \u201cSo it\u2019s reasonable to assume the contract is safe.\u201d<\/p>\n \u201cI think this hack stands out more than some bigger ones,\u201d Shegen said, noting that even if it was a smaller hack compared with\u00a0others that stole millions more<\/a>, the similarity to Aave meant \u201cit seems top tier safe, but wasn’t, and that break of trust hurts.\u201d<\/p>\n \u201cIt\u2019s like you can’t even trust \u2018safe\u2019 code.\u201d<\/p><\/blockquote>\n