2024 LI.FI Hack

LI.FI is a service that finds routes to swap and bridge tokens across many blockchains, and it powers swaps in many wallets and apps. Its main contract is built from separate parts that can be added or removed over time. On 16 July 2024, shortly after LI.FI added a new part, attackers found that it was missing a safety check that every other part of the contract used. This let them make the LI.FI contract move tokens out of wallets that had approved it. LI.FI later blamed human error during the deployment.

Attackers took about $11.6M in USDC, USDT and DAI from wallets on Ethereum and Arbitrum. Only wallets that had given LI.FI unlimited approvals were affected, because LI.FI's own apps and tools ask for exact approvals by default. LI.FI disabled the vulnerable part on all chains, asked users not to use LI.FI-powered apps while it investigated, and worked with law enforcement and security teams to trace the stolen funds. It also said it was working on a voluntary plan to fully compensate affected users.

Because the vulnerable part was removed and the rest of the contract stayed in use, this issue is fixed and existing approvals to LI.FI can no longer be abused through this bug. It was, however, the second time LI.FI suffered a similar approval exploit, after an earlier incident in 2022. Giving contracts exact rather than unlimited approvals limits how much can be taken if something goes wrong, and it is good practice to revoke approvals you no longer need.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.