Hedgey Finance (2024) — Crypto Hack
LaunderedA vulnerability in Hedgey Finance's token vesting and lockup contracts was exploited across multiple chains for ~$44.7M.
Summary
A vulnerability in Hedgey Finance's token vesting and lockup contracts was exploited across multiple chains for ~$44.7M.
How It Was Compromised — DeFi via Smart Contract Exploit
On April 19, 2024, Hedgey Finance, a token vesting and OTC deal platform, was exploited for approximately $44.7M across multiple chains including Ethereum, Arbitrum, Optimism, Polygon, and BSC. The attacker identified a vulnerability in the protocol's claimLockedTokens function that allowed them to bypass the intended lockup restrictions and withdraw tokens from vesting contracts that they did not own. The exploit affected multiple projects that had deployed vesting contracts using Hedgey's infrastructure.
Fund Flow & Laundering Analysis
Stolen tokens were swapped to ETH and stablecoins via decentralized exchanges across the affected chains. Funds were then bridged to Ethereum mainnet and deposited into Tornado Cash. The attacker also used cross-chain bridges to fragment the laundering trail. Hedgey Finance engaged with blockchain analytics firms and offered a bounty for the return of the funds.