Harvest Finance
Summary
Harvest Finance is a decentralized yield-aggregation protocol (token: FARM) that suffered a landmark $33.8 million flash loan-based price manipulation attack on October 26, 2020, one of the largest DeFi exploits of that year. Pre-attack, the protocol held over $1 billion in TVL while being governed by a single anonymous admin key—a concentration of power flagged by multiple security auditors and researchers. The protocol continues to operate with substantially reduced TVL (~$12 million as of 2025), though the stolen funds were never recovered and the attacker was never publicly identified or charged.
Connected Entities
1 entities- + 1 more
Timeline(13 events)
2020-09-01
Harvest Finance launches FARM token and begins yield aggregation operations; quickly accumulates over $1 billion in TVL.
2020-09-16
CertiK security audit begins; PeckShield and Haechi Labs audits also completed around this period, flagging single admin key governance risk.
2020-10-20
Researcher Chris Blec publicly documents Harvest Finance admin key centralization risks and reports being banned from the project's Discord after raising concerns.
2020-10-26
Flash loan price manipulation attack drains approximately $33.8 million from USDC and USDT vaults in under seven minutes. FARM token drops 65% within an hour. $570 million in TVL exits the platform within 12 hours.
2020-10-26
Attacker voluntarily returns approximately $2.5 million in USDC/USDT to the Harvest deployer address; motive is not explained.
2020-10-26
Harvest Finance offers a $100,000 bounty (raised to $400,000 within 36 hours) for information leading to return of stolen funds.
2020-10-27
Stolen funds begin moving through major exchanges including Binance, Kraken, Huobi, and BitMEX after being converted to Bitcoin via renBTC.
2020-10-29
Harvest Finance raises bounty to $1 million for information leading to recovery of exploited funds.
2020-11-01
Stolen Bitcoin traced through the Wasabi wallet mixing service; approximately 169 BTC remains unspent in tracked addresses at this date.
2020-11-30
Least Authority begins smart contract audit of Harvest Finance; audit concludes February 2021.
2020-12-07
GRAIN token claims portal launches, allowing affected USDC/USDT vault users to claim reparation tokens proportional to their loss.
2021-01-01
Harvest Finance continues operations; GRAIN buyback program is ongoing but full restitution of the approximately $31 million remaining loss is unconfirmed.
2025-01-01
Protocol operates with approximately $12.1 million TVL across five chains, primarily on Base network. FARM token trades near all-time lows. Anonymous team has not disclosed identities.
Decision Log
- hash: 9fTNfD4AB9x1FzSb8sQRqcFCQ3CaVKtHDUJuE3jVu1MV
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:55:00 AM
last updated: 5/25/2026, 5:34:28 PM
avoid.net — verified advice for a post-truth world