Beanstalk let a flash loan vote — and a $1B loan passed the budget

Beanstalk was a decentralized stablecoin protocol governed by token votes: proposals were executed if they won enough support from deposited tokens, with an emergency path that could act at once given a two-thirds majority. On 16 April 2022 an attacker submitted BIP-18 — a proposal that, behind an innocuous surface, transferred the protocol's funds to an attacker-controlled contract. Emergency execution required a one-day delay, so the proposal sat for 24 hours before anyone could act on it.

On 17 April, at roughly 12:24 UTC, the attacker struck: flash loans of more than $1 billion — $350 million DAI, $500 million USDC and $150 million USDT from Aave, about $32 million of BEAN via UniswapV2, almost $12 million of LUSD via SushiSwap — were converted into deposited tokens and thus into voting power. With that borrowed majority the attacker passed BIP-18 and drained the protocol's reserves in a single transaction, then repaid the flash loans out of the proceeds.

The total drain was $181 million. The team burned the remaining Beanstalk-native tokens sitting in the exploiter's contract, so the attacker walked away with around $77 million of non-Beanstalk assets. Beanstalk Farms suspended governance, paused the protocol and prepared a more secure relaunch; a separate attacker proposal had even routed $250,000 of BEAN tokens to Ukraine's official crypto donation address.