{"investigation":{"slug":"lendhub","entity_name":"LendHub","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.87,"status":"published","content_type":"investigation","summary":"LendHub was a decentralized cross-chain lending protocol operating primarily on the Huobi Eco Chain (HECO) and Binance Smart Chain (BSC). On January 12, 2023, the protocol suffered an approximately $6 million exploit caused by an operational failure to remove a deprecated IBSV cToken from its market, allowing an attacker to drain funds by arbitraging the two coexisting token versions. The protocol's TVL collapsed to near zero following the exploit, stolen funds were laundered through Tornado Cash, and the protocol is no longer considered operational.","sections":[{"content":"On January 12, 2023, LendHub suffered a critical exploit resulting in losses of approximately $6 million. The vulnerability did not involve a flaw in smart contract code itself but rather an operational oversight: when LendHub migrated from an old IBSV cToken to a new version, the team failed to remove the deprecated token from the market. Both old and new IBSV cTokens remained active and shared the same price feed. The attacker exploited this discrepancy by depositing HBSV tokens into the old market to receive inflated IBSV tokens, then borrowing assets from the new market, then redeeming HBSV back in the old market. This cycle was repeated to drain assets — including HDOT tokens — from the new market. Security firm Halborn noted that 'the attacker did not need to exploit smart contract vulnerabilities to carry out this attack. The attack was only possible because two competing versions of the same token were available on the market.' The incident was classified by DefiLlama as a 'Collateral Offboarding Mistake.'","heading":"The January 2023 Exploit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/lendhub","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the exploit, the attacker transferred funds cross-chain from the HECO network to Ethereum and other chains, using Transit Swap and Multichain as bridging infrastructure. Within hours of the exploit, over 1,100 ETH (approximately $1.79 million at the time) was sent to Tornado Cash, a sanctioned cryptocurrency mixer. On February 27, 2023, blockchain security firms PeckShield and Beosin identified a further transfer of 2,415 ETH (approximately $3.85 million) into Tornado Cash from a wallet connected to the exploit. In total, approximately 3,515 ETH (estimated at $5.7 million) was moved through Tornado Cash. The primary attacker wallet on Ethereum was identified as beginning with 0x9d016, with supporting contracts on the HECO chain identified beginning with 0xafef5 and 0xfced6. Funds were also distributed across Ethereum, Optimism, and HECO blockchains in DAI, USDT, and WBTC.","heading":"Fund Movement and Laundering","sources":[{"url":"https://cryptopotato.com/lendhub-exploiter-moves-proceeds-to-tornadocash/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","name":"certik.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the exploit, LendHub marketed itself as 'the safest decentralized lending platform' for cross-chain lending. This self-proclaimed designation drew significant criticism from the crypto community following the hack, as the incident was caused not by a sophisticated attack but by a basic operational failure — failure to clean up a deprecated token contract. Multiple outlets including The Block covered the irony of LendHub's security claims in light of the exploit. The vulnerability had potentially been present in the protocol since the token migration, meaning user funds were at risk for an extended period before the exploit was carried out.","heading":"Protocol Marketing vs. Security Reality","sources":[{"url":"https://www.theblock.co/post/202047/self-proclaimed-safest-defi-lender-loses-6-million-in-hack","name":"theblock.co","type":"other","credibility":3},{"url":"https://coincodecap.com/lendhub-the-safest-defi-lender-loses-6-million-in-a-hack","name":"coincodecap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the January 2023 exploit, LendHub's Total Value Locked (TVL) collapsed from approximately $6 million to $90,305. As of 2025, DefiLlama reports LendHub's TVL as $0, and the protocol is listed among dead or inactive adapters. The native governance token LHB trades at minimal value. The HECO chain itself announced its official retirement and urged users to convert and redeem their assets by January 10, 2025, further cementing LendHub's effective end of operations. No structured compensation plan for affected users has been publicly documented. LendHub acknowledged the exploit via its Twitter account but did not release a detailed official statement outlining specific remediation or compensation steps.","heading":"Protocol Collapse and Current Status","sources":[{"url":"https://defillama.com/protocol/lendhub","name":"defillama.com","type":"other","credibility":3},{"url":"https://crypto.news/the-heco-chain-announced-its-official-retirement-urging-users-to-convert-and-redeem-their-assets/","name":"crypto.news","type":"other","credibility":3},{"url":"https://crypto.news/lendhub-loses-6m-to-hackers/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"LendHub was launched on Huobi Global on May 6, 2021, and positioned as the leading lending protocol on the HECO chain, often compared to Compound Finance on Ethereum. The protocol distributed LHB governance tokens as borrowing incentives. The team maintained a close association with the Huobi ecosystem; HECO chain's official Medium channel published promotional content for LendHub. The core developer has been identified only by the name 'Jason' in publicly available AMA sessions; no further team member identities are publicly documented. The founders and developers have not been identified by name in connection with any regulatory or law enforcement action.","heading":"Team and Background","sources":[{"url":"https://hecochain.medium.com/introducing-lendhub-hecos-fastest-growing-lending-protocol-7716895a06c","name":"hecochain.medium.com","type":"other","credibility":3},{"url":"https://www.huobi.com/support/en-us/detail/104874608555069","name":"huobi.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Multiple blockchain security firms analyzed the LendHub exploit. SlowMist was among the first to identify the root cause as the coexistence of two IBSV cTokens sharing the same price oracle. CertiK published a detailed incident analysis confirming the deprecated token was never properly removed from the protocol. Halborn classified the attack as an operational failure rather than a smart contract exploit, noting it required no technical vulnerability — only the ability to interact with two simultaneously live markets. The incident is frequently cited in post-mortems as an example of inadequate protocol hygiene and governance risk during upgrades.","heading":"Security Analysis and Expert Assessment","sources":[{"url":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-05-06","event":"LendHub launched on Huobi Global and promoted as HECO chain's fastest-growing lending protocol.","source":""},{"date":"2023-01-11","event":"The exploiter received 100 ETH from Tornado Cash on Ethereum and began staging the attack.","source":""},{"date":"2023-01-12","event":"LendHub exploited for approximately $6 million via deprecated IBSV cToken arbitrage vulnerability. TVL collapsed from $6 million to $90,305.","source":""},{"date":"2023-01-13","event":"LendHub acknowledged the exploit via Twitter. SlowMist, CertiK, and Halborn published analyses.","source":""},{"date":"2023-01-12","event":"Over 1,100 ETH (~$1.79 million) transferred to Tornado Cash within hours of the exploit.","source":""},{"date":"2023-02-27","event":"PeckShield and Beosin alert that a further 2,415 ETH (~$3.85 million) was moved to Tornado Cash from the attacker wallet, bringing the total laundered amount to approximately $5.7 million.","source":""},{"date":"2024-11-10","event":"HECO chain announced official retirement; users urged to convert and redeem assets by January 10, 2025.","source":""},{"date":"2025-01-10","event":"HECO chain redemption deadline passed. LendHub TVL reached $0 on DefiLlama; protocol considered effectively defunct.","source":""}],"sources_used":[{"url":"https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023","name":"Explained: The LendHub Hack (January 2023) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260210161929/https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023","credibility":2,"archive_timestamp":"2026-02-10T16:19:29+00:00"},{"url":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","name":"Lendhub Incident Analysis — CertiK","type":"research","archive_url":"https://web.archive.org/web/20260725190651/https://www.certik.com/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","credibility":2,"archive_timestamp":"2026-07-25T19:06:51+00:00"},{"url":"https://www.theblock.co/post/202047/self-proclaimed-safest-defi-lender-loses-6-million-in-hack","name":"Self-proclaimed 'safest' DeFi lender loses $6 million in hack — The Block","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/lendhub-protocol-exploiters-spotted-shifting-3-85m-into-tornado-cash","name":"Lendhub protocol exploiters spotted shifting $3.85M into Tornado Cash — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20250827104713/https://cointelegraph.com/news/lendhub-protocol-exploiters-spotted-shifting-3-85m-into-tornado-cash","credibility":2,"archive_timestamp":"2025-08-27T10:47:13+00:00"},{"url":"https://cryptopotato.com/lendhub-exploiter-moves-proceeds-to-tornadocash/","name":"Lendhub Exploiter Moves Proceeds to TornadoCash — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20260417032311/https://cryptopotato.com/lendhub-exploiter-moves-proceeds-to-tornadocash/","credibility":2,"archive_timestamp":"2026-04-17T03:23:11+00:00"},{"url":"https://crypto.news/lendhub-loses-6m-to-hackers/","name":"LendHub loses $6m to hackers — Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260720101658/https://crypto.news/lendhub-loses-6m-to-hackers/","credibility":2,"archive_timestamp":"2026-07-20T10:16:58+00:00"},{"url":"https://defillama.com/protocol/lendhub","name":"LendHub — DefiLlama (TVL and protocol status)","type":"on_chain","archive_url":"http://web.archive.org/web/20250907230437/https://defillama.com/protocol/lendhub","credibility":2,"archive_timestamp":"2025-09-07T23:04:37+00:00"},{"url":"https://hecochain.medium.com/introducing-lendhub-hecos-fastest-growing-lending-protocol-7716895a06c","name":"Introducing LendHub — HECO Chain Medium","type":"official","archive_url":"http://web.archive.org/web/20260724171305/https://hecochain.medium.com/introducing-lendhub-hecos-fastest-growing-lending-protocol-7716895a06c","credibility":2,"archive_timestamp":"2026-07-24T17:13:05+00:00"},{"url":"https://crypto.news/the-heco-chain-announced-its-official-retirement-urging-users-to-convert-and-redeem-their-assets/","name":"HECO Chain retirement announcement — Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260515013640/https://crypto.news/the-heco-chain-announced-its-official-retirement-urging-users-to-convert-and-redeem-their-assets/","credibility":2,"archive_timestamp":"2026-05-15T01:36:40+00:00"},{"url":"https://bitcoinist.com/lendhub-hackers-move-3-85-million-in-crypto/","name":"Hackers of Crypto Platform Lendhub Move $3.85 Million Into Tornado Cash — Bitcoinist","type":"news_article","archive_url":"http://web.archive.org/web/20260605223506/https://bitcoinist.com/lendhub-hackers-move-3-85-million-in-crypto/","credibility":2,"archive_timestamp":"2026-06-05T22:35:06+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:45.299851+00:00","updated_at":"2026-08-29T01:34:05.633+00:00"}}