An attacker managed to pull off a $542,000 heist from Lien Finance by exploiting a bug in how the protocol handles bond tokens. The vulnerability allowed them to create bond tokens out of thin air and cash them out for real USDC, draining liquidity from the platform.
Security firm SlowMist detailed how the attacker manipulated the exchangeEquivalentBonds function in Lien Finance’s BondMakerCollateralizedEth contract. Instead of verifying that each bond ID was correctly accounted for during token swaps, the code only checked the total count of exceptions. This loophole let the attacker reuse certain bond IDs repeatedly, fooling the system into minting new tokens without actually burning the underlying bonds.
These fake bond tokens were then converted to genuine USDC via pre-approved channels, resulting in the protocol losing around 542,144 USDC. The attacker’s wallet address has been identified as 0x0d7d…1808a. The compromised contracts were 0xda6fc5…bef0 and 0x843225…47de.
Further on-chain analysis from DefimonAlerts and researcher exvulsec highlighted that this was a failure in protocol logic that combined weak permissionless bond registration with pricing flaws in Lien Finance’s over-the-counter bond pools. The attacker deployed a contract that registered new bond groups without restrictions, exploiting the system’s pricing and validation layers.
This incident adds to a growing list of DeFi hacks this month where vulnerabilities in token validation and pricing mechanisms have been targeted. Every time a protocol lets users register assets permissionlessly without strict checks, it risks similar exploits.
