Humanode patches EVM flaw as Hifi faces $1M loss

Humanode confirmed that it deployed a fix within 40 minutes of the attack and promised full reimbursement for affected owners. Hifi Finance’s incident was disclosed by blockchain researcher Spreek, who reported that four last-minute governance votes enabled an attacker to pass a malicious proposal, upgrade a core contract and move collateral held by the lending protocol.

The financial figures require careful interpretation. Humanode’s attacker received approximately 18,804 USDC from selling the stolen tokens, but that amount does not represent the full value of the assets taken. Hifi’s 25 million HIFI figure represents newly minted tokens, not a $25 million loss. The reported collateral transfer was valued at approximately $1 million, with a complete official post-mortem and independently verified final accounting still unavailable in the reporting reviewed.

Humanode patches EVM vulnerability after 12.77 million eHMND theft

Humanode’s official incident report places the attack at 15:00:42 UTC on October 28. The attacker exploited stateful EVM precompiles that improperly accepted DELEGATECALL and CALLCODE, allowing attacker-controlled code to execute through another contract’s identity and spend existing WeHMND allowances.

Humanode’s custom EVM environment exposes native blockchain functions to smart contracts. Its native-currency precompile provides the WeHMND interface used by contracts to interact with eHMND, the network’s EVM-side representation of its native token.

The vulnerability arose because the stateful precompiles accepted delegated execution paths that should have been rejected. Under DELEGATECALL, code from another contract executes in the context of the calling contract, preserving its identity and access to its storage. Humanode’s implementation allowed the attacker to abuse that behavior to exercise existing token approvals without obtaining fresh signatures from affected owners.

The distinction is significant: the attack did not require the attacker to obtain a new transaction signature from every victim. Existing approvals were sufficient for the affected allowance-based paths. The earlier Cosmos EVM vulnerability that drained $5.7 million across six blockchains similarly demonstrated how defects in an EVM execution environment can expose assets across applications that depend on the underlying software.

Humanode confirmed that 12,773,243.03 eHMND was taken from 436 accounts, including the ChainPort eHMND vault. Of those accounts, 281 were left with zero eHMND. The impact was concentrated in specific EVM accounts with existing WeHMND approvals and the affected vault; native-side HMND balances outside the EVM were not reachable through the reported vulnerability.

The ChainPort vault loss also created a shortfall in the Humanode-side backing of its wrapped token on other chains. Humanode said it had resolved the malicious approval affecting the vault and was continuing to investigate the attacker’s movements.

The fix was deployed at 15:40:48 UTC, 40 minutes and six seconds after the attack began, through activation of runtime specification 134. Humanode said subsequent read-only checks confirmed that the exploited call paths were blocked. The patch rejects DELEGATECALL and CALLCODE across the four affected stateful custom precompiles while preserving ordinary native-currency calls.

The attacker sold approximately 12,734,327 eHMND into the Impossible Swap WeHMND/USDC liquidity pool, receiving 18,804.19 USDC. The pool’s quoted spot price fell from approximately 0.002617 USDC per eHMND to 0.000837 USDC, a decline of about 68%.

Approximately 38,915.92 eHMND separated the total amount taken from the amount sold into that pool. Humanode said the destination of the remaining tokens had not been confirmed and that the attacker’s identity remained unknown.

The project pledged full reimbursement of affected owners and restoration and rebalancing of the eHMND/USDC pool. It also froze its decentralized exchange, bridges and liquidity-pool staking for 72 hours from publication of its October 28 announcement to address the imbalance and conduct further audits and investigation. Reimbursement instructions and timing had not yet been finalized in the report.

Hifi Finance governance takeover reportedly drains $1 million

A separate incident involving Hifi Finance was disclosed by researcher Spreek at 22:25:36 UTC on October 28. The researcher reported that an attacker gained control of the protocol’s decentralized autonomous organization governance through four last-minute votes that enabled malicious Proposal 21 to pass.

According to the initial account, addresses funded through Tornado Cash supplied the votes needed to secure the proposal’s approval. The attacker subsequently upgraded Hifi’s BalanceSheet contract, minted 25 million HIFI tokens and transferred user collateral valued at approximately $1 million, predominantly tokens associated with real-world assets.

The reported sequence suggests that the attacker exploited governance authority rather than relying solely on a conventional smart-contract vulnerability. Once the malicious proposal passed, the attacker reportedly gained the permissions needed to change a core contract and then use the resulting control to mint tokens and move collateral.

Governance systems are designed to let token holders approve changes to protocol parameters, contracts and treasury arrangements. However, if voting power can be captured and used to authorize unrestricted asset movements, the governance process itself can become the route through which customer funds are compromised.

The available incident accounts leave important questions unanswered. Hifi’s published governance documentation has described a five-day voting period and a two-day timelock, but the initial reporting does not fully explain how Proposal 21 was executed in relation to those safeguards. The precise voting timeline, permissions used for the contract upgrade and the current status of affected collateral require further verification.

As of the latest information reviewed, a complete official post-mortem and independently verified final loss accounting were not available. The approximately $1 million figure should therefore be treated as a reported collateral-loss estimate rather than a definitive final accounting.

Two attacks expose weaknesses in DeFi security architecture

Humanode and Hifi Finance illustrate why decentralized finance security requires protection at both the execution and governance layers. The first incident involved a flaw in the blockchain environment beneath the applications using it. The second reportedly involved control over the protocol’s own authorization process.

Humanode’s vulnerability shows that correctly functioning token allowances can still be abused if the underlying execution environment permits unintended access paths. Custom precompiles and runtime modifications therefore require dedicated security testing, including checks for call types that could change the identity under which sensitive operations execute.

Ethereum’s smart-contract security guidance emphasizes the importance of secure access controls, extensive testing, independent reviews and robust emergency procedures. These principles apply equally to customized EVM environments, where deviations from expected execution behavior can create risks that ordinary application-level audits may not detect.

Hifi’s case raises a different concern: governance mechanisms can become dangerous when a small voting majority can approve changes with immediate consequences for protocol assets. The X100 governance exploit, which generated approximately $4.85 million in reported USDT proceeds, demonstrated how attackers can use a compromised voting structure to authorize treasury and liquidity operations. Hifi’s reported takeover reinforces the need to examine voting thresholds, proposal execution delays and the permissions granted to upgraded contracts.

These incidents also underline why headline token quantities are insufficient measures of financial damage. Humanode’s 18,804 USDC in sale proceeds does not measure the full value of affected balances or the cost of restoring liquidity. Likewise, 25 million newly minted HIFI tokens cannot be treated as equivalent to $25 million in cash or collateral.

Earlier DeFi incidents, including the BitBay StableVault exploit involving approximately 14,838 DAI, demonstrate how weaknesses in contract logic can turn apparently valid operations into unauthorized withdrawals. The technical mechanisms differ, but the broader lesson is consistent: the security of financial assets depends on the integrity of the rules that govern their movement.

Recovery commitments and unanswered questions remain critical

Humanode has confirmed a deployed fix, outlined its containment measures and committed to reimbursing affected owners in full. The next milestones are publication of reimbursement instructions, restoration of the affected liquidity pool and completion of the investigation into the remaining token movements and attacker’s identity.

For Hifi Finance, the immediate priorities are to establish the precise governance sequence, verify the collateral transferred, determine the current status of the upgraded contract and identify whether assets can be recovered. An official post-mortem would also help users understand how Proposal 21 passed and what safeguards will prevent a similar takeover.

Investors should distinguish remediation commitments from completed recovery. A promise to reimburse users does not establish that funds have already been returned, just as deploying a software fix does not by itself resolve the financial consequences of an exploit.

Neither incident establishes that every application built on Humanode or every asset associated with Hifi Finance was compromised. The consequences depend on the affected execution paths, existing approvals, governance permissions and collateral arrangements.

Nevertheless, both attacks underline a central challenge for DeFi: decentralization does not eliminate the need for tightly controlled permissions, independently verified upgrades and effective emergency procedures. Humanode’s rapid technical response addresses its immediate vulnerability, while Hifi’s case demonstrates why governance safeguards must prevent a temporary or malicious voting majority from becoming unrestricted control over user assets.

The final assessment will depend on verified recovery figures, technical disclosures and evidence that the underlying weaknesses have been permanently addressed. Until those details emerge, the confirmed token movements, reported collateral losses and outstanding recovery commitments should remain separate measures of the incidents’ impact.