Humanode and Hifi Finance hit by separate DeFi attacks

Humanode confirmed that it had deployed a fix within 40 minutes of the attack and committed to reimbursing affected token holders in full. Hifi Finance’s incident, disclosed by blockchain researcher Spreek, involved four last-minute governance votes that reportedly enabled an attacker to take control of the protocol’s decision-making process and upgrade a core contract.

The incidents have different financial implications. Humanode disclosed the exact quantity of tokens taken and the attacker’s realized sale proceeds, while Hifi’s approximately $1 million collateral estimate remains subject to further verification. Neither incident’s reported token quantities should be confused with dollar-denominated losses.

Humanode patches EVM flaw after 12.77 million eHMND theft

Humanode’s official incident report states that the attack began at 15:00:42 UTC on October 28. The attacker exploited stateful EVM precompiles that improperly accepted DELEGATECALL and CALLCODE, enabling attacker-controlled code to act through another contract’s identity and spend existing WeHMND allowances.

The vulnerability affected Humanode’s custom EVM execution environment, which exposes native blockchain functions to smart contracts. The native-currency precompile provides the WeHMND interface used by contracts to interact with eHMND, the network’s EVM-side representation of its native token.

Under normal EVM execution, DELEGATECALL allows code at another address to execute in the context of the calling contract. The Solidity documentation explains how delegated execution retains the calling contract’s context, including its storage and address. Humanode’s vulnerability arose because its stateful precompiles did not properly reject these delegated call paths.

The attacker used the weakness to spend previously authorized token allowances without obtaining fresh signatures from the affected owners. Humanode confirmed that 12,773,243.03 eHMND was taken from 436 accounts, including the ChainPort eHMND vault. Of those accounts, 281 were left with zero eHMND.

The incident did not expose every form of Humanode asset ownership. According to the project, native-side HMND balances held outside its EVM environment were not reachable through the vulnerability. The loss was concentrated in affected EVM accounts with existing approvals and the compromised vault.

Humanode deployed its fix at 15:40:48 UTC, just 40 minutes and six seconds after the attack began. The update activated runtime specification 134 and blocked the affected delegated-call paths. The project also confirmed that it had resolved the malicious approval affecting the ChainPort vault.

The attacker sold approximately 12.734 million eHMND into the Impossible Swap WeHMND/USDC liquidity pool, receiving 18,804.19 USDC. The pool’s quoted spot price fell from approximately 0.002617 USDC per eHMND to 0.000837 USDC, a decline of about 68%.

The 18,804.19 USDC represents the attacker’s sale proceeds, not the full value of the assets taken from affected owners. Humanode’s report also identifies approximately 38,915.92 eHMND separating the total amount stolen from the amount sold through the identified pool. The destination of those remaining tokens has not been confirmed.

Humanode pledged full reimbursement for affected owners and said it would restore and rebalance the liquidity pool. It also froze its decentralized exchange, bridges and liquidity-pool staking for 72 hours from the publication of its October 28 announcement while further investigation and auditing continued. Reimbursement instructions and timing had not yet been finalized in the report.

Hifi Finance governance takeover drains user collateral

A separate incident involving Hifi Finance was disclosed by blockchain researcher Spreek at 22:25:36 UTC on October 28. The researcher reported that an attacker obtained control of Hifi’s decentralized autonomous organization governance through four last-minute votes that enabled malicious Proposal 21 to pass.

According to the initial investigation, addresses funded through Tornado Cash supplied the votes used to secure the proposal’s approval. The attacker subsequently upgraded Hifi’s BalanceSheet contract, minted 25 million HIFI tokens and transferred approximately $1 million in user collateral, predominantly tokens representing real-world assets.

The distinction between the two headline figures is essential. The 25 million HIFI figure describes the quantity of newly minted governance tokens, not a $25 million theft. The approximately $1 million estimate refers to the reported value of collateral transferred from the protocol.

The reported sequence suggests that the attacker exploited governance authority rather than relying solely on a conventional smart-contract vulnerability. By obtaining sufficient voting power to pass a malicious proposal, the attacker could reportedly authorize a change to a core contract and then use the resulting control to mint tokens and move collateral.

Governance systems are intended to allow token holders to approve changes to protocol parameters, contracts and treasury arrangements. However, when voting thresholds and execution safeguards fail to protect against hostile control, the same authority can be used to redirect assets that users believe are protected by the protocol’s rules.

The reported speed of the takeover also leaves an important question unresolved. Hifi’s published governance documentation has described a five-day voting period and a two-day timelock, but the initial incident accounts do not explain how Proposal 21’s execution fitted those safeguards. A complete technical post-mortem will need to clarify the proposal’s timeline, the governance permissions involved and the precise mechanism used to upgrade the BalanceSheet contract.

As of the latest information available for this report, a complete official post-mortem and independently verified final loss accounting had not been established. The reported $1 million collateral transfer should therefore be treated as an initial estimate rather than a definitive final loss figure.

Two attacks expose different weaknesses in DeFi security

Humanode and Hifi Finance illustrate why decentralized finance security requires protection at both the execution and governance layers.

Humanode’s vulnerability existed in the blockchain environment beneath the applications using its EVM. The affected precompiles were intended to expose native functionality to smart contracts, but their handling of delegated execution allowed existing permissions to be used in an unintended way. The episode demonstrates that even applications with properly functioning allowance mechanisms can be exposed when the underlying execution environment does not enforce the expected call restrictions.

A similar distinction emerged in the Cosmos EVM flaw that drained $5.7 million across six blockchains. That incident highlighted the potential for weaknesses in shared execution software to affect multiple applications and networks. Humanode’s case reinforces the need to audit custom precompiles and runtime-level behavior, rather than focusing exclusively on application contracts.

Hifi Finance presents a different challenge. Governance mechanisms can provide a legitimate way to coordinate upgrades, but they also concentrate substantial authority in voting rules, proposal execution and administrative permissions. If an attacker can gain control of those mechanisms, the protocol’s own authorization process may become the route through which assets are moved.

The X100 governance exploit, which generated approximately $4.85 million in reported USDT proceeds, provides another example of how compromised governance can enable treasury or liquidity manipulation without requiring a conventional exploit of every affected asset contract. The Hifi incident similarly raises questions about whether voting power, proposal delays and contract-upgrade authority were adequately separated.

These incidents also demonstrate why the value of stolen assets must be reported carefully. Humanode’s attacker realized only 18,804.19 USDC from the identified eHMND sale, but that figure does not measure the total value of affected balances or the cost of restoring liquidity. At Hifi, 25 million newly minted HIFI tokens cannot be valued as though they were equivalent to $25 million in cash or collateral.

Recovery commitments and unresolved questions remain critical

Humanode has taken concrete containment measures, deployed a runtime fix and promised to reimburse affected owners in full. The next milestones are the publication of reimbursement instructions, restoration of the liquidity pool and completion of the investigation into the unexplained token movements and the attacker’s identity.

For Hifi Finance, the immediate priorities are different. Investigators need to establish the exact governance sequence, verify the collateral transferred, determine the current status of the upgraded contract and identify whether any assets can be recovered. A clear official response would also help users understand the status of their collateral and the controls intended to prevent another governance takeover.

Investors should distinguish between remediation commitments and completed recovery. A promise to reimburse users does not establish that funds have already been returned, just as the deployment of a software fix does not by itself resolve the financial consequences of an exploit.

The incidents do not establish that every application built on Humanode or every asset associated with Hifi Finance was compromised. Their consequences are specific to the affected execution paths, approvals, governance mechanisms and collateral arrangements.

Nevertheless, both attacks underline a central challenge for DeFi: decentralization does not eliminate the need for tightly controlled permissions, independently verified upgrades and effective emergency procedures. Humanode’s rapid technical response addresses the immediate vulnerability, while Hifi’s case underscores the importance of ensuring that governance cannot become a shortcut around the protections users expect.

The final assessment will depend on verified recovery figures, technical disclosures and evidence that the underlying weaknesses have been permanently addressed. Until those details emerge, the confirmed token movements, reported collateral losses and outstanding recovery commitments should remain separate measures of the incidents’ impact.