Back
BarnBridge Smart Yield on Ethereum exploited after governance takeover, about $776,000 lost

BarnBridge Smart Yield on Ethereum exploited after governance takeover, about $776,000 lost

BlockSec Phalcon said an attacker gained DAO governance rights, upgraded Smart Yield controller logic and used a privileged function plus existing USDC approvals from 50 accounts to drain pooled funds.

ETH
USDC

Fact Check
The primary source, the BlockSec Phalcon X post (@Phalcon_xyz), directly confirms all specific elements of the claim: the ~$776K loss, the governance takeover, the controller proxy upgrade to malicious implementation, use of the privileged _takeUnderlying function, and draining pooled funds via 50 accounts' pre-existing USDC approvals on Ethereum. The PANews article reproduces the same details citing that same Phalcon post, and a Blockaid alert independently corroborates the token-approval attack vector on the BarnBridge Smart Yield governance proposals. The claim is an accurate summary of the authoritative security-firm report; it is described as an estimated/suspected loss, which is standard for freshly detected incidents.
    Reference: 123
Summary

BarnBridge SMART Yield (cUSDC) on Ethereum was attacked, with losses of about $776,000, in an incident that appears to have escalated from the governance-related approval risk flagged earlier. BlockSec Phalcon said the attacker obtained DAO governance rights, upgraded the SmartYield/controller proxy to a malicious implementation, and then used CompoundProvider's privileged _takeUnderlying function together with pre-existing USDC approvals from 50 user accounts to move pooled funds through transferFees. The case highlights how token approvals can become a direct loss vector when governance control and upgradeable contract logic are compromised.

Terms & Concepts
  • DAO governance rights: Control within a decentralized autonomous organization that can authorize protocol changes or upgrades.
  • token approvals: Permissions that allow a smart contract to move a user's tokens.
  • proxy: A smart contract setup that lets protocol logic be upgraded without changing the main contract address.