DeFi Exchange Hacker Returns Stolen Funds to ‘Nurse’ After $6m Attack

Share Article
In Brief
  • DeFi Protocol Value was exploited over the weekend, losing close to $6 million of user funds.

  • One user claiming to be a nurse, contacted the attacker and asked for the funds to be returned.

  • The hacker partially complied returning $50k of the users $100k lost funds.

  • promo

    Want to know more? Join our Telegram Group and get trading signals, a free trading course and daily communication with crypto fans!

The Trust Project is an international consortium of news organizations building standards of transparency.

Over the weekend, an abnormal transaction caught the attention of multiple crypto analysts.



In the incident in question, an anonymous user withdrew 80,000 ETH worth of flash loans from Aave, plus $116 million in flash loans from Uniswap.

They then used the funds to manipulate the price of stablecoins on Curve to withdraw around $6 million from Value DeFi, a yield aggregator protocol.



One whitehat hacker described this series of maneuvers as the most complicated exploit they’d ever seen. Once the dust settled, the attacker returned a significant chunk of the total to the deployer address for the Value DeFi protocol. Such returns have become a pattern for DeFi attackers, seemingly an act of pity or consolation for exploited users.

Value DeFi Exploiter Address – Etherscan

For its part, Value confirmed the attack, tweeting, “The MultiStables vault was the subject of a complex attack that resulted in a net loss of $6M.”

Later, the Value team published a full post mortem stating that it “deeply regrets this latest incident” and that it was lining up a compensation plan for victims funded by “a combination of the dev fund, insurance fund and a portion of the fees generated by the protocol.”

Given the large sum stolen, the attack affected many of Value’s users. Some even resorted to contacting the attacker by including messages into Ethereum transactions.

One claiming to be a nurse said that they had invested their life savings or close to $100,000 into the protocol hoping to earn a yield and begged the attacker to return the funds.

Many observers on Twitter instantly questioned this user’s authenticity, citing their use of English and the unlikeness of their gender and profession:

Perhaps surprisingly, the DeFi attacker responded by donating $50,000 worth of stablecoins to the user. Value’s developers have also reportedly tried to contact the attacker to negotiate the further return of funds; at press time, there is no word if these attempts have been successful.

Share Article

Colin is a writer, researcher, and content marketer with a keen interest in the future of money. His writing has been featured in numerous cryptocurrency publications, and his holdings don't amount to more than a handful of BAT.

Follow Author

Daily signals, Bitcoin analytics and traders chat. Join our Telegram today!

Let’s Go
Daily signals and Bitcoin analytics.