{"investigation":{"slug":"agave","entity_name":"Agave","trust_score":52,"severity_base":null,"score_modifier":34,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Agave was a decentralized lending protocol on Gnosis Chain forked from Aave v2, developed by members of the 1Hive community. On March 15, 2022, the protocol suffered a reentrancy exploit that drained approximately $5.5 million in user funds, part of a coordinated $11.7 million attack that simultaneously hit Hundred Finance. The protocol paused operations following the hack and formally closed down in March 2024 with no documented user compensation.","sections":[{"content":"On March 15, 2022, between approximately 11:25 and 11:28 AM UTC+1, an attacker exploited a reentrancy vulnerability in Agave's lending contracts on Gnosis Chain, draining approximately 2,116 ETH valued at roughly $5.5 million at the time. The same attacker simultaneously exploited Hundred Finance for an additional $6.2 million, bringing total losses to approximately $11.7 million across both protocols. The attacker's wallet address associated with the Agave exploit was 0x0a16a85be44627c10cee75db06b169c7bc76de2c. Stolen assets included Wrapped ETH (WETH), Wrapped BTC (WBTC), Chainlink (LINK), USDC, Gnosis (GNO), and Wrapped xDAI (WXDAI). Within hours of the exploit, stolen funds were transferred to Tornado Cash for laundering. The AGVE token dropped more than 20% in the immediate aftermath.","heading":"Reentrancy Exploit — March 2022","sources":[{"url":"https://rekt.news/agave-hundred-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.theblock.co/post/137932/defi-protocols-agave-and-hundred-finance-exploited-on-gnosis-chain-for-11-million","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/03/15/defi-lending-protocol-agave-plunges-over-20-amid-exploit-investigation","name":"coindesk.com","type":"other","credibility":3},{"url":"https://fortune.com/crypto/2022/03/16/crypto-investor-scam-agave-defi/","name":"fortune.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The vulnerability exploited was not in Agave's core Aave-forked code but in its deployment environment. Official bridged tokens on Gnosis Chain are non-standard ERC-677 tokens that include a callAfterTransfer() hook, which triggers a callback to the receiving contract after every token transfer. Agave's contracts did not implement protections against this behavior — such as the checks-effects-interactions pattern or a reentrancy guard — allowing an attacker to recursively re-enter borrow functions before debt balances were updated. The attacker used flash loans as initial collateral, nested multiple borrow calls within a single transaction to exploit the vulnerability window, and then terminated the sequence with a liquidationCall to repay the flash loan while retaining the borrowed assets. Security researcher Mudit Gupta noted that Aave on mainnet actively screens tokens for reentrancy risk before listing them, a check that Agave did not perform on Gnosis Chain's bridged token set.","heading":"Root Cause: Non-Standard Token Hooks on Gnosis Chain","sources":[{"url":"https://rekt.news/agave-hundred-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/the-agave-and-hundred-finance-hack-a-11-7m-reentrancy-exploit","name":"vidma.io","type":"other","credibility":3},{"url":"https://medium.com/immunefi/a-poc-of-the-hundred-finance-heist-4121f23a098","name":"medium.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/unlucky-agave-and-hundred-finance-defi-protocols-exploited-for-11m","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Agave announced it was investigating and paused all contracts to prevent further losses. The protocol stated: 'Agave is currently investigating an exploit on the agave finance protocol. We will update you as soon as we know more.' No documented compensation plan for affected users was publicly announced. The protocol remained effectively dormant after the hack. On approximately March 25, 2024, the Agave DAO formally announced its closure, directing token holders to a redemption portal at agavefinance.eth.limo/redeem/. At the time of the formal closure announcement, the protocol's TVL had fallen to approximately $81,000, compared to peak levels prior to the exploit. No recovery of stolen funds was reported.","heading":"Protocol Response and Closure","sources":[{"url":"https://www.coindesk.com/business/2022/03/15/defi-lending-protocol-agave-plunges-over-20-amid-exploit-investigation","name":"coindesk.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/agave","name":"defillama.com","type":"other","credibility":3},{"url":"https://x.com/agave_lending","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Individual users suffered significant losses in the exploit. One affected investor, known online as Shegenerates, reported losing over $225,000 in the attack. She described discovering the exploit when the interest rate on the protocol spiked to nearly 100% and all deposited funds were shown as borrowed. She characterized the DeFi environment as 'still the Wild West,' comparing the loss to historical bank robberies. The stolen assets were broadly distributed across the user base that had deposited funds into Agave's lending markets, including deposits in WETH, WBTC, LINK, USDC, GNO, and WXDAI.","heading":"User Impact and Victim Accounts","sources":[{"url":"https://fortune.com/crypto/2022/03/16/crypto-investor-scam-agave-defi/","name":"fortune.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Agave was built by active members of the 1Hive community, a decentralized organization that also operates the Honeyswap decentralized exchange. The protocol was a fork of Aave v2 deployed on xDAI (later rebranded as Gnosis Chain), with the AGVE governance token used for protocol governance. The team operated under the 1Hive collective structure rather than as a named, publicly identified team. The AGVE token reached an all-time high of approximately $1,466 before the exploit and the eventual protocol wind-down; as of 2025, the token trades at roughly $26–34, representing a decline of approximately 97–98% from its all-time high. The protocol's GitHub organization is available at github.com/Agave-DAO.","heading":"Protocol Background and Team","sources":[{"url":"https://wiki.1hive.org/projects/agave","name":"wiki.1hive.org","type":"other","credibility":3},{"url":"https://medium.com/honeyswap/1hive-introduction-to-agave-agve-100e36fe3560","name":"medium.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/agave-token","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the attacker transferred the stolen funds to Tornado Cash within hours. Approximately 2,116 ETH from the Agave portion of the exploit and 2,363 ETH from the Hundred Finance portion were sent through Tornado Cash, making on-chain tracing and fund recovery effectively impossible. No law enforcement action, attacker identification, or asset recovery has been publicly reported in connection with this exploit.","heading":"Fund Laundering via Tornado Cash","sources":[{"url":"https://rekt.news/agave-hundred-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://cryptopotato.com/defi-protocols-agave-hundred-finance-hacked-attacker-steals-11m-worth-of-crypto/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"Agave protocol launched on xDAI (Gnosis Chain) by the 1Hive community as a fork of Aave v2","source":"","date_original":"2021-01-01"},{"date":"2022-03-15","event":"Reentrancy exploit drains approximately $5.5 million from Agave and $6.2 million from Hundred Finance simultaneously; total losses $11.7 million. Attacker address: 0x0a16a85be44627c10cee75db06b169c7bc76de2c","source":""},{"date":"2022-03-15","event":"Agave pauses all contracts and announces investigation via Twitter","source":""},{"date":"2022-03-15","event":"Stolen funds transferred to Tornado Cash within hours of exploit; approximately 4,479 ETH laundered in total across both protocols","source":""},{"date":"2022-03-15","event":"AGVE token price drops more than 20% following public disclosure of exploit","source":""},{"date":"2024-03-25","event":"Agave DAO formally announces closure; redemption portal opened at agavefinance.eth.limo/redeem/ for AGVE token holders","source":""}],"sources_used":[{"url":"https://rekt.news/agave-hundred-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260503003355/https://rekt.news/agave-hundred-rekt","credibility":3,"archive_timestamp":"2026-05-03T00:33:55+00:00"},{"url":"https://www.theblock.co/post/137932/defi-protocols-agave-and-hundred-finance-exploited-on-gnosis-chain-for-11-million","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260725170058/https://www.theblock.co/post/137932/defi-protocols-agave-and-hundred-finance-exploited-on-gnosis-chain-for-11-million","credibility":3,"archive_timestamp":"2026-07-25T17:00:58+00:00"},{"url":"https://www.coindesk.com/business/2022/03/15/defi-lending-protocol-agave-plunges-over-20-amid-exploit-investigation","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260725152909/https://www.coindesk.com/business/2022/03/15/defi-lending-protocol-agave-plunges-over-20-amid-exploit-investigation","credibility":3,"archive_timestamp":"2026-07-25T15:29:09+00:00"},{"url":"https://fortune.com/crypto/2022/03/16/crypto-investor-scam-agave-defi/","name":"fortune.com","type":"other","archive_url":"https://web.archive.org/web/20260830203639/https://fortune.com/crypto/2022/03/16/crypto-investor-scam-agave-defi/","credibility":3,"archive_timestamp":"2026-08-30T20:36:39+00:00"},{"url":"https://www.vidma.io/blog/the-agave-and-hundred-finance-hack-a-11-7m-reentrancy-exploit","name":"vidma.io","type":"other","archive_url":"http://web.archive.org/web/20260315233236/https://www.vidma.io/blog/the-agave-and-hundred-finance-hack-a-11-7m-reentrancy-exploit","credibility":3,"archive_timestamp":"2026-03-15T23:32:36+00:00"},{"url":"https://medium.com/immunefi/a-poc-of-the-hundred-finance-heist-4121f23a098","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260706040457/https://medium.com/immunefi/a-poc-of-the-hundred-finance-heist-4121f23a098","credibility":3,"archive_timestamp":"2026-07-06T04:04:57+00:00"},{"url":"https://cointelegraph.com/news/unlucky-agave-and-hundred-finance-defi-protocols-exploited-for-11m","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260830125310/https://cointelegraph.com/news/unlucky-agave-and-hundred-finance-defi-protocols-exploited-for-11m","credibility":3,"archive_timestamp":"2026-08-30T12:53:10+00:00"},{"url":"https://defillama.com/protocol/agave","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250914002101/https://defillama.com/protocol/agave","credibility":3,"archive_timestamp":"2025-09-14T00:21:01+00:00"},{"url":"https://x.com/agave_lending","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://wiki.1hive.org/projects/agave","name":"wiki.1hive.org","type":"other","archive_url":"http://web.archive.org/web/20260521071814/https://wiki.1hive.org/projects/agave","credibility":3,"archive_timestamp":"2026-05-21T07:18:14+00:00"},{"url":"https://medium.com/honeyswap/1hive-introduction-to-agave-agve-100e36fe3560","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingecko.com/en/coins/agave-token","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260421092457/https://www.coingecko.com/en/coins/agave-token","credibility":3,"archive_timestamp":"2026-04-21T09:24:57+00:00"},{"url":"https://cryptopotato.com/defi-protocols-agave-hundred-finance-hacked-attacker-steals-11m-worth-of-crypto/","name":"cryptopotato.com","type":"other","archive_url":"https://web.archive.org/web/20260830125501/https://cryptopotato.com/defi-protocols-agave-hundred-finance-hacked-attacker-steals-11m-worth-of-crypto/","credibility":3,"archive_timestamp":"2026-08-30T12:55:01+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:50.71091+00:00","updated_at":"2026-08-30T20:47:32.680548+00:00"}}