A devastating flash loan attack on Beanstalk Farms, a decentralized credit-based stablecoin protocol built on Ethereum, has resulted in the loss of approximately $182 million in collateral, marking one of the most significant DeFi exploits in crypto history and sending shockwaves through the decentralized finance community.
TL;DR
- Beanstalk Farms lost $182 million in a flash loan governance exploit on Ethereum
- The attacker borrowed $1 billion from Aave to gain majority voting power and drain protocol funds
- Approximately $80 million in net profit went to the attacker
- The attack exploited Beanstalk’s lack of execution delay on governance proposals
- Bitcoin was trading around $40,424 at the time, with ETH near $3,062
How the Attack Unfolded
The exploit was a sophisticated governance attack that leveraged flash loans — a DeFi mechanism allowing users to borrow massive amounts of capital without collateral, provided the loan is repaid within the same blockchain transaction. The attacker borrowed $1 billion worth of assets from Aave, denominated in DAI, USDC, and USDT stablecoins.
With this enormous capital, the attacker purchased 32 million BEAN tokens from Uniswap V2 worth approximately $6.4 million, along with $11 million in LiquityUSD (LUSD) from SushiSwap. The attacker then minted 3CRV tokens by adding liquidity to the DAI/USDC/USDT pool on Curve Finance, converting 15 million 3CRV to 11.6 million LUSD tokens in the process.
Governance Mechanism Exploited
The core vulnerability lay in Beanstalk’s governance structure. The protocol uses Stalk tokens — ERC-20 standard tokens that bestow governance rights and voting power on holders. Participants earn Stalk by depositing Bean stablecoins into the protocol’s central funding pool called the Silo, receiving four Seeds per Bean deposited.
By amassing a massive quantity of Stalk tokens through the flash loan proceeds, the attacker acquired over 67% of the protocol’s voting power. This supermajority allowed them to pass a malicious governance proposal that drained the protocol’s funds into a private Ethereum wallet. The stolen funds were sent to wallet address 0x1c5dCdd006EA78a7E4783f9e6021C32935a10fb4.
A Growing Trend of Flash Loan Attacks
This attack is the second nine-figure DeFi exploit in a single month, following the $625 million Ronin bridge hack in late March. Flash loan attacks have become increasingly common in the DeFi sector due to their low-risk, low-cost, and high-reward nature. Unlike traditional 51% attacks that require massive computational resources, flash loans require only a computer, an internet connection, and careful planning.
Previous major flash loan attacks include the PancakeBunny exploit on Binance Smart Chain in May 2021 and two separate attacks on C.R.E.A.M. Finance in August and October 2021, the latter resulting in $136 million in losses. The Beanstalk attack further highlights the systemic risks inherent in governance mechanisms that lack time-locked execution delays.
Market Context
The attack occurred against a backdrop of broader crypto market weakness. Bitcoin was trading at approximately $40,424 at the time, down 5.51% over the preceding seven days, while Ethereum hovered around $3,062, down 3.43% in the previous 24 hours. The total Bitcoin market capitalization stood at roughly $768.6 billion, with Ethereum’s market cap at approximately $368.7 billion.
The macro environment was increasingly hostile to risk assets, with the U.S. Federal Reserve signaling aggressive rate hikes and tightening monetary policy. Bond investors had been pummeled as the central bank intensified its fight against inflation, creating additional headwinds for cryptocurrency markets.
Why This Matters
The Beanstalk exploit exposes a fundamental weakness in DeFi governance: when voting power is directly proportional to token holdings without time delays, any attacker with sufficient capital can hijack the entire protocol in a single transaction. The fact that $1 billion in flash loans was sufficient to steal $182 million raises serious questions about the security model of token-governed DeFi protocols.
For the broader crypto ecosystem, this attack underscores the urgent need for governance time locks, multi-signature requirements, and more robust security frameworks in decentralized protocols. As DeFi continues to grow in total value locked, the incentive for sophisticated attacks will only increase, making security audits and governance safeguards more critical than ever.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions.
$1 billion borrowed from Aave in a single tx to take over governance. this is why flash loans are simultaneously the best and worst thing defi ever invented
the problem isnt flash loans, its protocols that let flash loan holders vote. aave did nothing wrong, beanstalk designed governance that could be bought
zigzag_trade aave did nothing wrong is correct. flash loans are neutral, beanstalk handing governance keys to whoever borrows the most was the suicide move
No execution delay on governance proposals was the real killer. A 24-hour timelock would have prevented this entirely.
Samuel D a 24h timelock would have saved 182M. the simplest fix in the world, just not implemented. costs nothing, prevents everything
Anka P. a 24h timelock costs literally nothing to implement and would have saved 182M. beanstalk is the textbook case for why governance delays are non-negotiable
a 24h timelock is free and would have saved 182M. protocols that skip this after Beanstalk have zero excuse
governance_drift_ a timelock would have saved Beanstalk but the deeper issue is flash loans enabling instant governance capture. any protocol with token voting and no quorum requirement is vulnerable to the same attack
governance_drift_ a timelock would have saved beanstalk but the deeper issue was using token votes where you can buy voting power mid-proposal. flash loans just made it trivially cheap
the attacker made $80m net profit from what was essentially a governance exploit any dev could have dreamed up. protocol design flaw not a hack
BTC at $40k and ETH at $3k and people still had bandwidth to drain $182m from a stablecoin nobody had heard of. DeFi was truly unhinged in 2022.
had a small bag in beanstalk. the discord went from chill farming discussion to full panic in about 4 minutes. still have the screenshots somewhere
bean_bag_ 4 minutes from chill farming to full panic is wild. i remember watching the discord in real time. people posting screenshots of their balances going to zero
watching the discord go from farming to panic in 4 minutes is forever burned into my memory. that was the day governance design became a real topic
borrowing 1B from Aave to pass a governance vote with zero timelock is still the most degen thing thats ever worked in defi. 182M gone in one tx
borrowing 1B from Aave to pass a governance vote with zero timelock is still the craziest defi exploit ever. 182M gone in one transaction because of one missing line of code
no_timelock_ a 24 hour delay on governance execution costs nothing to implement and would have saved 182M. protocols that skip this after Beanstalk have zero excuse
80M net profit for the attacker after returning the flash loan. beanstalk basically paid someone to destroy their own protocol
the attacker made 80M net profit after returning the flash loan. beanstalk basically paid someone to destroy their own protocol lol
just found out about this attack 2 years later. how does protocol design miss something this obvious?
still shaking my head at beanstalk having no timelock on governance. 182M lost because of one missing line of code
the attacker borrowed 1B from aave and the protocol had no circuit breaker. 182M gone in one tx. defi was so careless in 2022 it hurts to look back
Yuki M. Aave lending 1B in a single flash loan and Beanstalk having zero guard rails. the DeFi composability that everyone celebrated was also the attack vector. building blocks of destruction
Yuki M. no circuit breaker AND no timelock. beanstalk was basically a protocol that ran on trust lol