Furucombo Hack

Furucombo is an app that lets users combine several DeFi actions, such as borrowing, swapping and lending, into a single transaction, like building blocks. To do this, users approved Furucombo's main contract to spend their tokens, often without any limit. On 27 February 2021, an attacker found a way to make that contract believe the lending protocol Aave, one of its trusted integrations, had released a new version. That supposed new version was actually the attacker's own malicious code, which then ran with all the permissions users had given to Furucombo.

The attacker used this to take over $14M in 21 different tokens, including stETH, USDC, USDT and DAI, and routed the proceeds through the Tornado Cash mixer. About an hour after the attack started, Furucombo removed the Aave integration from its list of allowed contracts, which blocked the attacker's next attempt. The team reported the hack to the authorities and later announced a compensation plan, giving affected users a claim on 5 million of its COMBO tokens, paid out gradually over 360 days.

Approvals that users gave to Furucombo's main contract stay active until they are revoked, and security researchers at the time urged everyone to revoke them. If you used Furucombo on Ethereum around early 2021, check your wallet and revoke any approvals that remain for this contract. Revoking protects the tokens that are still in your wallet, but it does not recover funds that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.