Recent DeFi Bridge Breach Costs Meter $4.4 Million

The Meter Passport token bridge platform suffered a $4.4 million loss due to a smart contract hack, which also resulted in a $3.3 million loss for Hundred Finance due to undercollateralized loans.

Meter Passport (MTRG) by Meter.io is a token bridge compatible with Ethereum and its sidechains. This attack affected Moonriver.

Moonriver is a smart contract platform based on Polkadot's Kusama network. Hundred Finance is a crypto lending platform based on Compound Finance code.

According to a statement from Meter on Feb. 6, a total of approximately $4.4 million was minted in BNB and wETH over the course of several transactions starting at 2pm UTC on Feb. 5 through a “false trust assumption” in the code. In this case, an arbitrary amount of ETH is deposited into Meter, and hackers use the vulnerability to mint tokens.

The attack caused a cascading effect in the Kusama-based Moonriver ecosystem. After depleting Meter's BNB and wETH reserves, the attacker sold BNB on the popular decentralized exchange SushiSwap. This caused the price of BNB on Moonriver to plummet by 77% at the time.

Many opportunists then took advantage of the falling price by buying cheap BNB. They use these tokens as collateral on Hundred Finance for FRAX and MIM stablecoin loans. However, due to the difference in BNB prices, their loans were worth more than the collateral they provided, causing a supply crisis.

Amazingly, two of those loans were repaid, leaving the Hundred agreement with $3.3 million in outstanding losses. The Hundred team attempted to contact the relevant parties to request that they return the BNB tokens used as collateral to Meter.

The Meter team has committed to indemnify its community and Hundred Finance for the damages suffered due to the hack. The team said on Feb. 6 that it had set aside $4.4 million in MTRG tokens to cover initial losses.

Hundred Finance’s pseudonymous founder “Vfat” said in a statement to Rekt News on February 6:

“Meter has of course accepted responsibility for this hack and intends to use their native tokens to compensate wherever possible, and we are currently at the stage of collecting addresses and amounts.”

Blockchain security firm PeckShield estimates that a total of 1,391 ETH and 2.74 wBTC were stolen by the attackers and sent to Ethereum, where the tokens circulated through Tornado Cash, an ETH transaction privacy tool.

Hundred Finance has not responded to a request for comment.

Initial details of exploiting Meter’s code are similar to the Feb. 3 Wormhole hack, in which 120,000 wETH ($321 million) were maliciously minted and withdrawn from Wormhole’s platform. In that incident, the hacker used a smart contract vulnerability to mint wETH at will, and sent the tokens to Ethereum, where they were laundered through Tornado Cash.