Belt Finance announced it had suffered a flash loan attack with total losses of $6.2 million. Belt Finance is an AMM protocol that integrates sales optimization with multiple strategies in Binance Smart Chain (BSC).

Binance Smart Chain Protocol in Another Flash Loan Attack

The hacker managed to steal BUSD worth $6.2 million. This is Binance’s native USD-linked stablecoin, converted to ETH via 1-inch DEX and partially withdrawn to Ethereum by Binance Smart Chain.

This type of hacking is relatively harmless: only $6.2 million was stolen from Belt Finance’s massive $2.6 billion total value locked (TVL).

The BeltBUSD vault uses four strategies. A bug in the Elipsis strategy was used to withdraw funds on the Venus strategy.

The vault sends new deposits to the strategy with the lowest reservation and pays the withdrawal from the strategy with the most reservations to strike a balance between these four strategies. If the 3EPS pool becomes unbalanced, an error in the Elipsis strategy leads to an incorrect value calculation.

Hackers used quick loans to convert about $200 million from BUSD to USDT, unbalance the 3EPS pool, and activate the loophole in the Elipsis strategy. At that point, the 4Belt pool would have overestimated the hacker’s inventory and, after receiving a flash loan, would have paid another 0.5% of the profit. A single flash loan transaction of $200 million generated a profit of $1 million.

The hacker repeated the transaction many times and made a net profit of $6.2 million, resulting in a total loss of $13 million from paying a $6 million fee to the 3EPS pool.

Like other current hacks in the Binance Smart Chain ecosystem, this hack has also led to the condemnation of the “fork culture”. In this case, the entire codebase can be copied without full verification. In the past few weeks, this issue has led to several flash loan attacks.