Verify a decision

{"actor":"system:backfill","investigation_id":"fedd4b2c-80f6-4551-8c7b-8cbb51a55c28","kind":"publish","page_slug":"beanstalk","published_at":"2026-05-19T21:12:20.736Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Beanstalk","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2022/04/17/attacker-drains-182m-from-beanstalk-stablecoin-protocol"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/once-hacked-for-77m-beanstalk-s-algo-stablecoin-protocol-relaunches"},{"credibility":3,"name":"","type":"other","url":"https://bean.money/beanstalk.pdf"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/beanstalk-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-beanstalk-hack-april-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/beanstalk-defi-platform-loses-182-million-in-flash-loan-attack/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/immunefi/hack-analysis-beanstalk-governance-attack-april-2022-f42788fc821e"},{"credibility":3,"name":"","type":"other","url":"https://www.bloomberg.com/news/articles/2022-04-18/defi-project-beanstalk-loses-182-million-in-flash-loan-attack"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/beanstalk-rekt"},{"credibility":3,"name":"","type":"other","url":"https://blog.merklescience.com/hacktrack/hack-track-analysis-of-beanstalk-flash-loan-attack-hack-track-merkle-science"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/revisiting-beanstalk-farms-exploit"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/beanstalk-farms-offers-plea-deal-to-perpetrators-of-76m-exploit"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/once-hacked-for-77m-beanstalk-s-algo-stablecoin-protocol-relaunches"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/06/02/beanstalk-stablecoin-protocol-barn-raise-aims-to-restore-77m-in-lost-funds"},{"credibility":3,"name":"","type":"other","url":"https://bean.money/blog/path-forward"},{"credibility":3,"name":"","type":"other","url":"https://www.techtarget.com/searchsecurity/news/252516215/Cryptocurrency-theft-leaves-Beanstalk-Farms-future-in-doubt"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/beanstalk"},{"credibility":3,"name":"","type":"other","url":"https://github.com/Cyfrin/2024-04-beanstalk-2"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.bankinfosecurity.com/stablecoin-protocol-beanstalk-loses-millions-in-attack-a-18918"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/beanstalk-defi-platform-loses-182-million-in-flash-loan-attack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/beanstalk-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-beanstalk-hack-april-2022"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/beanstalk"},{"credibility":3,"name":"","type":"other","url":"https://www.coingecko.com/en/coins/bean"}]}],"sources_used":[],"summary":"Beanstalk is an Ethereum-based algorithmic stablecoin protocol that on April 17, 2022 suffered one of DeFi's largest governance exploits, losing approximately $182 million after an attacker used flash loans to acquire a supermajority vote and pass a malicious proposal draining the protocol's treasury. The protocol relaunched in August 2022 following a community fundraiser called the Barn Raise, but its BEAN stablecoin has never recovered its peg and total value locked remains a fraction of pre-exploit levels.","timeline":[{"date":"2021-08-06","event":"Beanstalk protocol launched on Ethereum mainnet by pseudonymous founders 'Publius' (Benjamin Weintraub, Brendan Sanderson, Michael Montoya).","source":""},{"date":"2022-04-16","event":"Attacker submits malicious BIP-18 and BIP-19 governance proposals to Beanstalk, initiating the required 24-hour governance delay.","source":""},{"date":"2022-04-17","event":"At approximately 12:24 PM UTC, attacker executes flash loan attack using over $1 billion borrowed from Aave, acquires ~79% of governance votes, passes BIP-18 via emergencyCommit, and drains approximately $182 million from the protocol. Approximately 24,930 ETH ($76M net profit) is transferred to Tornado Cash in 270 transactions.","source":""},{"date":"2022-04-18","event":"Beanstalk Farms team pauses the protocol, disables on-chain governance, and transfers control to a community multisig. Founders reveal their identities on Discord to dispel complicity concerns.","source":""},{"date":"2022-04-18","event":"Beanstalk Farms sends on-chain message offering attacker a 10% whitehat bounty in exchange for returning 90% of funds. Attacker does not respond.","source":""},{"date":"2022-06-06","event":"Barn Raise fundraiser launches, targeting $77 million in recapitalization via Fertilizer token sales.","source":""},{"date":"2022-08-04","event":"BIP-21 (the Replant proposal) reaches supermajority. Barn Raise has attracted over $17 million USDC — approximately 22% of the target.","source":""},{"date":"2022-08-06","event":"Beanstalk protocol officially relaunches ('Replant') with governance under community multisig and restructured tokenomics.","source":""},{"date":"2024-04-01","event":"Cyfrin conducts security audit of Beanstalk 2 upgrade, including BEAN:wstETH liquidity whitelisting.","source":""},{"date":"2024-05-01","event":"Cyfrin conducts security audit of Beanstalk 3, which includes plans for Ethereum L2 migration.","source":""},{"date":"2025-05-01","event":"BEAN trades at approximately $0.23 (77% below peg). Protocol TVL approximately $9 million. Attacker identity remains unknown; stolen funds unrecovered.","source":""}]},"v":1}