Verify a decision

{"actor":"system:backfill","investigation_id":"a4cdbf3f-f874-467d-a4f3-dd4422fa10f8","kind":"publish","page_slug":"harvest-finance","published_at":"2026-05-25T17:34:28.362Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Harvest Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2020/10/26/harvest-finance-24m-attack-triggers-570m-bank-run-in-latest-defi-exploit","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/46445/engineering-error-34-million-defi-hack-harvest-finance","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/82292/defi-protocol-harvest-finance-exploited","type":"other","url":""},{"credibility":3,"name":"https://slowmist.medium.com/slow-mist-analysis-of-harvest-finances-hacked-event-63450b49e6a5","type":"other","url":""},{"credibility":3,"name":"https://www.scorechain.com/blog/5-days-after-the-harvest-finance-hack-what-we-know-so-far","type":"other","url":""},{"credibility":3,"name":"https://immunebytes.com/blog/harvest-finance-fund-theft-incident-oct-26-2020-detailed-analysis/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2020/10/26/harvest-finance-24m-attack-triggers-570m-bank-run-in-latest-defi-exploit","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/harvest-finance-grapples-to-make-users-whole-after-34m-hack","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/anonymous-devs-behind-a-defi-yield-farm-could-steal-1b-in-12-hours","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/harvest-finance-developers-adamant-keeping-1-billion-project-centralized/","type":"other","url":""},{"credibility":3,"name":"https://survivingdefi.substack.com/p/hunting-harvests-admin-key","type":"other","url":""},{"credibility":3,"name":"https://finxflo.medium.com/what-did-we-learn-about-anonymity-from-the-harvest-finance-24-million-hack-eb608d070e2f","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2020/10/29/harvest-finance-boosts-bounty-to-1m-for-information-leading-to-return-of-exploited-funds","type":"other","url":""},{"credibility":3,"name":"https://securityaffairs.com/110043/cyber-crime/harvest-finance-cyber-heist.html","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/46303/harvest-finance-issue-100000-bounty-on-hacker","type":"other","url":""},{"credibility":3,"name":"https://www.scorechain.com/blog/5-days-after-the-harvest-finance-hack-what-we-know-so-far","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/harvest-finance/announcing-the-grain-claims-portal-20dd12c4f631","type":"other","url":""},{"credibility":3,"name":"https://docs.harvest.finance/general-info/security/grain-token","type":"other","url":""},{"credibility":3,"name":"https://x.com/harvest_finance/status/1325676438721351681","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.harvest.finance/other/security/audites","type":"other","url":""},{"credibility":3,"name":"https://leastauthority.com/blog/audit-of-harvest-smart-contracts-for-harvest-finance/","type":"other","url":""},{"credibility":3,"name":"https://farm.chainwiki.dev/en/security","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/harvest-finance","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/harvest-finance/","type":"other","url":""}]}],"sources_used":[],"summary":"Harvest Finance is a decentralized yield-aggregation protocol (token: FARM) that suffered a landmark $33.8 million flash loan-based price manipulation attack on October 26, 2020, one of the largest DeFi exploits of that year. Pre-attack, the protocol held over $1 billion in TVL while being governed by a single anonymous admin key—a concentration of power flagged by multiple security auditors and researchers. The protocol continues to operate with substantially reduced TVL (~$12 million as of 2025), though the stolen funds were never recovered and the attacker was never publicly identified or charged.","timeline":[{"date":"2020-09-01","event":"Harvest Finance launches FARM token and begins yield aggregation operations; quickly accumulates over $1 billion in TVL.","source":""},{"date":"2020-09-16","event":"CertiK security audit begins; PeckShield and Haechi Labs audits also completed around this period, flagging single admin key governance risk.","source":""},{"date":"2020-10-20","event":"Researcher Chris Blec publicly documents Harvest Finance admin key centralization risks and reports being banned from the project's Discord after raising concerns.","source":""},{"date":"2020-10-26","event":"Flash loan price manipulation attack drains approximately $33.8 million from USDC and USDT vaults in under seven minutes. FARM token drops 65% within an hour. $570 million in TVL exits the platform within 12 hours.","source":""},{"date":"2020-10-26","event":"Attacker voluntarily returns approximately $2.5 million in USDC/USDT to the Harvest deployer address; motive is not explained.","source":""},{"date":"2020-10-26","event":"Harvest Finance offers a $100,000 bounty (raised to $400,000 within 36 hours) for information leading to return of stolen funds.","source":""},{"date":"2020-10-27","event":"Stolen funds begin moving through major exchanges including Binance, Kraken, Huobi, and BitMEX after being converted to Bitcoin via renBTC.","source":""},{"date":"2020-10-29","event":"Harvest Finance raises bounty to $1 million for information leading to recovery of exploited funds.","source":""},{"date":"2020-11-01","event":"Stolen Bitcoin traced through the Wasabi wallet mixing service; approximately 169 BTC remains unspent in tracked addresses at this date.","source":""},{"date":"2020-11-30","event":"Least Authority begins smart contract audit of Harvest Finance; audit concludes February 2021.","source":""},{"date":"2020-12-07","event":"GRAIN token claims portal launches, allowing affected USDC/USDT vault users to claim reparation tokens proportional to their loss.","source":""},{"date":"2021-01-01","event":"Harvest Finance continues operations; GRAIN buyback program is ongoing but full restitution of the approximately $31 million remaining loss is unconfirmed.","source":""},{"date":"2025-01-01","event":"Protocol operates with approximately $12.1 million TVL across five chains, primarily on Base network. FARM token trades near all-time lows. Anonymous team has not disclosed identities.","source":""}]},"v":1}