Agave & Hundred Finance Exploit
Summary
On March 15, 2022, Agave (an Aave fork on Gnosis Chain) and Hundred Finance (a Compound fork deployed on Gnosis Chain) were simultaneously exploited via a reentrancy attack that abused post-transfer callback hooks in Gnosis Chain's non-standard ERC-677 bridged tokens, resulting in combined losses of approximately $11.7 million. Hundred Finance suffered a second major exploit in April 2023 on Optimism ($7.4 million), after which the protocol voted to shut down permanently in August 2023. Agave continued operating in diminished capacity before its DAO formally wound down in early 2024.
Connected Entities
1 entities · 10 linked investigationsTimeline(8 events)
2021-03-11
Agave Finance introduces itself publicly as a money market lending and borrowing protocol on the xDai (Gnosis) network, forked from Aave.
Agave Finance Medium2022-03-15
Agave DAO and Hundred Finance are simultaneously exploited via a reentrancy attack on Gnosis Chain abusing ERC-677 onTokenTransfer() callbacks. Agave loses ~2,116 ETH ($5.5M); Hundred Finance loses ~2,363 ETH ($6.2M). Combined loss: ~$11.7M. Both protocols pause contracts.
Rekt News / The Block / CoinDesk2022-03-15
Stolen funds from both exploits are bridged to Ethereum mainnet and deposited into Tornado Cash mixer within hours of the attack.
SlowMist / Rekt News2022-03-17
SharkTeam publishes a technical flash loan and reentrancy attack analysis of the Hundred Finance and Agave exploit.
SharkTeam2023-04-15
Hundred Finance is exploited a second time, this time on Optimism (Ethereum L2), via exchange-rate manipulation on an empty hWBTC market combined with a rounding error. Loss: ~$7.4M. HND token falls ~46%. Protocol pauses all chain deployments.
Cointelegraph / Decrypt / Halborn2023-08-09
Hundred Finance governance votes to shut down the protocol with ~99% approval on Snapshot. Remaining treasury funds directed toward victim compensation. Protocol operations cease.
Web3 Is Going Great / Hundred Finance X2024-03-25
Agave DAO formally closes down after completing its phase-out process. AGVE token holders directed to a redemption portal at agavefinance.eth.limo/redeem/.
Agave Finance website / GitHub phase-out-tooling2024-04-01
The attacker who stole $7.4M from Hundred Finance in April 2023 begins moving the stolen assets approximately one year after the exploit, routing them through Curve Finance.
DL News / CointelegraphDecision Log
- hash: 7rRSXX2DWHW4rTMdRNawBS1iYMkM69HoGn4Bkz6nm8MU
- hash: SgaS2148JZCgw4ErpJwSUmuRwi27DFnbVU2LSYJc9VM
- hash: DGHrNzTBvA35Fa18Hdo8Hh3aPajgy3ZWMTx934zchCCn
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/1/2026, 5:46:40 PM
last updated: 6/8/2026, 10:20:13 PM
avoid.net — verified advice for a post-truth world