On 17 April 2022 the Ethereum-based stablecoin protocol Beanstalk Farms lost approximately $182 million. Reporting describes the attacker taking a flash loan of around $1 billion in stablecoins from the Aave protocol, using it to acquire enough of Beanstalk’s governance token to control roughly two thirds of voting power, passing proposals they had themselves submitted the previous day, draining the protocol’s reserves, and repaying the loan. The attacker is reported to have retained around $80 million.
A flash loan is borrowed and repaid within a single transaction; if repayment fails the whole transaction reverts, so the lender takes no risk and the borrower needs no collateral.
The Governance Worked
There was no buffer overflow, no unchecked call, no stolen key. A proposal was submitted, a supermajority voted for it, and it executed. Every component behaved as specified.
We filed this category repeatedly and it is the hardest one to defend against: 22-0922, where an API answered everyone because nothing told it not to; 22-0404, where a former employee read what they had been entitled to read. A system doing precisely what it was built to do, to someone’s severe detriment, produces no alert anywhere.
Voting Power You Can Rent By The Second
The design assumption underneath token governance is that holding a governance token means having a stake in the outcome — that a voter who wrecks the protocol wrecks their own holding.
A flash loan severs that. For the duration of one transaction the attacker held the majority and none of the exposure, because the position existed only long enough to vote. The assumption was never written down as a control, which is why nothing enforced it.
What The Corpus Can And Cannot Say
This desk files crypto losses at 26-0722 and 26-0614 and is cautious about them. Figures are drawn from on-chain analysis rather than audited accounts, and the gap between "value moved" and "value realised" is often large — here, $182 million lost against roughly $80 million retained.
What is not in doubt is the mechanism, because it is on a public ledger. That is the one respect in which this corner of the corpus is better evidenced than the rest of it: the transaction is readable by anyone, forever, which is not true of a single notification letter this database records.
Compiled from contemporaneous reporting and on-chain analyses, listed below. The distinction between the protocol’s loss and the attacker’s realised gain is preserved rather than collapsed into one headline figure. No individual or address is named. Subsequent recovery efforts and any later attribution are outside the scope of this file. Graded high on the mechanism, which is publicly verifiable on-chain. Corrections: corrections@forensicpost.com.