Raft Suffers $3.3M Exploit That Drove Down Stablecoin 50%, but Hacker Likely Lost Money on Attack

Decentralized finance (DeFi) platform Raft lost some $3.3 million in ether (ETH) after being hacked Friday afternoon – but the attacker may have suffered a loss on the heist.

On-chain data shows that the attacker drained 1,577 ETH from Raft, then sent 1,570 ETH to a burn address – destroying most of the stolen assets and leaving only 7 ETH for themselves. The hacker's address received 18 ETH via crypto mixer service Tornado Cash before the attack, blockchain data on Arkham shows, likely to fund transactions.

After executing the transfers and paying the blockchain fees, the exploiter's crypto wallet was left with only 14 ETH, fewer funds than the initial 18 ETH.

This means that they face a 4 ETH loss on the whole maneuver.

Raft's R dollar-pegged stablecoin dropped as much as 50% from its supposed $1 price in the immediate aftermath, but later rebounded to around 70 cents, Coinmarketcap data shows.

Raft co-funder David Garai confirmed in a post on X (formerly Twitter) that the platform was targeted by an attack. The exploiter minted R tokens, which then were sold to drain automated market maker liquidity, while simultaneously withdrew collateral from Raft, Garai explained.

"We are trying to make people whole using the protocol-owned sDAI in the Peg Stability Module," Garai told CoinDesk in a Telegram message.

Raft is a DeFi lending platform, which issues the R stablecoin collateralized by liquid staking ether (ETH) derivatives such as Lido's stETH. Users can mint R token if they lock up ETH derivatives.

This was the second major crypto exploit on Friday. Earlier during the day, an attacker drained about $114 million in digital assets from centralized exchange Poloniex.

UPDATE (Nov. 11, 22:10 UTC): Adds context, details about the exploit from Raft founder.