Harvest Finance
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 55. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +8. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6.4 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -1.6 |
| Long-running | +8 |
| Sum | 55 |
Score: 55/100 (kept between 0 and 100)
How scoring works →Summary
Harvest Finance is a decentralized yield-aggregation protocol (token: FARM) that suffered a landmark $33.8 million flash loan-based price manipulation attack on October 26, 2020, one of the largest DeFi exploits of that year. Pre-attack, the protocol held over $1 billion in TVL while being governed by a single anonymous admin key—a concentration of power flagged by multiple security auditors and researchers. The protocol continues to operate with substantially reduced TVL (~$12 million as of 2025), though the stolen funds were never recovered and the attacker was never publicly identified or charged.
Connected Entities
15 entities · 60 linked investigations- Ethereum→mentioned with→Coinbase(60%)
- Ethereum→mentioned with→Bitcoin(60%)
- Harvest Finance→mentioned with→Binance(70%)
- BitMEX→mentioned with→Bitcoin(70%)
- Harvest Finance→mentioned with→Kraken(70%)
- Harvest Finance→mentioned with→SushiSwap(60%)
- Harvest Finance→mentioned with→ZKsync(60%)
- Harvest Finance→mentioned with→Bitcoin(75%)
- Harvest Finance→mentioned with→Ethereum(65%)
- Harvest Finance→mentioned with→Polygon(60%)
- + 36 more
Timeline(13 events)
September 2020
Harvest Finance launches FARM token and begins yield aggregation operations; quickly accumulates over $1 billion in TVL.
16 September 2020
CertiK security audit begins; PeckShield and Haechi Labs audits also completed around this period, flagging single admin key governance risk.
20 October 2020
Researcher Chris Blec publicly documents Harvest Finance admin key centralization risks and reports being banned from the project's Discord after raising concerns.
26 October 2020
Flash loan price manipulation attack drains approximately $33.8 million from USDC and USDT vaults in under seven minutes. FARM token drops 65% within an hour. $570 million in TVL exits the platform within 12 hours.
26 October 2020
Attacker voluntarily returns approximately $2.5 million in USDC/USDT to the Harvest deployer address; motive is not explained.
26 October 2020
Harvest Finance offers a $100,000 bounty (raised to $400,000 within 36 hours) for information leading to return of stolen funds.
27 October 2020
Stolen funds begin moving through major exchanges including Binance, Kraken, Huobi, and BitMEX after being converted to Bitcoin via renBTC.
29 October 2020
Harvest Finance raises bounty to $1 million for information leading to recovery of exploited funds.
November 2020
Stolen Bitcoin traced through the Wasabi wallet mixing service; approximately 169 BTC remains unspent in tracked addresses at this date.
30 November 2020
Least Authority begins smart contract audit of Harvest Finance; audit concludes February 2021.
7 December 2020
GRAIN token claims portal launches, allowing affected USDC/USDT vault users to claim reparation tokens proportional to their loss.
2021
Harvest Finance continues operations; GRAIN buyback program is ongoing but full restitution of the approximately $31 million remaining loss is unconfirmed.
2025
Protocol operates with approximately $12.1 million TVL across five chains, primarily on Base network. FARM token trades near all-time lows. Anonymous team has not disclosed identities.
Decision Log
- slot 455369183 · hash 4MCvX57Bcg7Jx8Kkz6sdySsD2XtC4cvhN4cyjTLAegEx
- slot 422113853 · hash 9fTNfD4AB9x1FzSb8sQRqcFCQ3CaVKtHDUJuE3jVu1MV
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 15 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:55:00 AM
last updated: 10/10/2026, 6:49:13 PM
3 viewsavoid.net — verified advice for a post-truth world