Vault Exploit Drains $4.5M From Eleven Finance's Nerve-Bridged Assets

Eleven.finance, a yield aggregator running on Binance Smart Chain and Polygon, lost $4.5 million to an exploit. Early speculation on Twitter pointed toward Nerve Finance itself being under attack, given its much larger footprint, but the incident was actually confined to Eleven Finance's NRV vault.

The vulnerability traced back to an emergencyBurn() function inside an intermediary vault contract. That contract was responsible for tracking anySwap- and Nerve-bridged assets — nrvBTC, nrvETH, and nrvFUSDT — within Eleven's "MasterMind" farming contract, and its emergencyBurn() function let withdrawals bypass internal accounting entirely.

To set up the attack, the exploiter flash-loaned the underlying token balance of each asset held in the MasterMind contract — Binance-pegged BTC, ETH, and USDT — and converted those into their corresponding Nerve-wrapped forms (nrvBTC, nrvETH, nrvFUSDT). Liquidity positions tied to the Nerve 3Pool and to the PancakeSwap BUSD-NRV pair were caught up in the damage as well.

Because withdrawals through the flawed function weren't tracked internally, the attacker was able to pull out not just their own newly-deposited funds but an equivalent amount matching whatever balance already sat in the vault beforehand — effectively doubling their take on each pass. Proceeds were routed out through the Nerve bridge: 2,293 ETH sent to 0xdb2d590aCe7cAe51DF1fB3312738038Ec032Bf33.

The mechanics broke down into five steps: borrow the underlying assets via a PancakeSwap flash swap; mint the equivalent Nerve-wrapped asset; deposit that wrapped asset into MasterMind through the intermediary vault; call emergencyBurn() on the intermediary vault to siphon out an amount matching the vault's pre-existing balance; and finally execute an ordinary withdrawal to reclaim the originally deposited funds too.

Losses broke down as roughly 30.75 BTCB ($1.05M) drained from the nrvBTC side, 286 ETH ($561K) from nrvETH, 2.241M BUSD (~$2.241M) from the Nerve 3Pool LP position, and a further 0.647M BUSD ($647K) from the NRV-BUSD LP.

Transaction details are available on BscScan, with the discovery credited to researcher 0xdeadf4ce.

With $4.5 million lost, the incident landed the protocol in 27th place on the running rekt leaderboard. PeckShield described the underlying cause simply as a flawed piece of logic — a reminder of how a modest coding oversight can translate into an eight-figure loss. Commentary at the time also pointed to rising fear-and-greed sentiment across the market as a possible driver of further opportunistic attacks.