Cyber Incident Victim: Revest Finance
Date:
Mar 2022
Location:
United States of America
Summary
A decentralized finance protocol suffered a $2 million theft due to a re-entrancy vulnerability in its Ethereum smart contracts, enabling attackers to drain multiple tokens including BLOCKS, ECO, LYXe, and RENA. The stolen assets were converted to Ether and laundered through TornadoCash, with most remaining untraceable except for RENA holdings. The platform confirmed an inability to recover funds or provide insurance coverage, instead announcing plans to collaborate on an NFT initiative aiming to raise at least 700 Ether for victim reimbursement. Security firms analyzed the attack mechanics, noting inadequate reentrancy safeguards, while the protocol committed to enhanced audits and patching before resuming operations. Development of compensation specifics was underway following the exploit.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 27, 2022, decentralized finance protocol Revest Finance disclosed a $2 million theft resulting from an exploit targeting its Ethereum smart contracts. The attack was first detected after the BLOCKS DAO development team alerted Revest to suspicious activity. Blockchain security firm PeckShield analyzed the incident, identifying the theft of 7,699,999 ECO tokens (approximately $100,000), 579 LYXe ($10,000), 714,999,999 BLOCKS ($1.7 million), and 352,835 RENA ($120,000). The hacker exploited a re-entrancy vulnerability in Revest's code, enabling repeated unauthorized withdrawals before previous transactions finalized. This flaw allowed the attacker to drain funds across multiple integrated protocols. Following the theft, the hacker converted the stolen tokens into Ether and laundered proceeds through TornadoCash, a privacy-focused mixing service. Security firms PeckShield and BlockSec later published technical analyses confirming the attack leveraged inadequate reentrancy protections in Revest's contract design.
Revest CEO Rob Montgomery confirmed the platform lacked DeFi insurance coverage and could not recover the stolen assets. In response, the company announced plans to collaborate with blockchain firm Blocks on an NFT series intended to raise at least 700 Ether (then valued around $1.4 million) to partially reimburse affected users. Montgomery stated development of this compensation mechanism would begin immediately, with specifics to follow. Concurrently, Revest initiated security enhancements including comprehensive audits and a patch undergoing peer review before deployment. Operations remained suspended pending implementation of the fix. Forensic analysis indicated most stolen funds were irrecoverable due to laundering, though RENA tokens remained in the hacker's wallet at the time of reporting. The incident highlighted systemic risks in smart contract security while demonstrating Revest's operational limitations regarding fund recovery and victim restitution.