Manually Altered Balance Lets One Address Siphon $1.75M From Bent Finance

Bent Finance, a staking and farming platform built to boost Curve returns, lost roughly $1.75 million over several weeks to a single address that quietly extracted funds before the issue was addressed — and evidence points to the cause being internal rather than a conventional smart-contract exploit.

Initial disclosure

After the price of $BENT dropped on the news, the team issued a muted statement saying rewards had been paused but claiming no funds had actually been lost. That position shifted after PeckShield reported that the exploit appeared to originate from within the project itself, prompting Bent Finance to publish a follow-up update that read, to many, like an acknowledgment of an inside job. Analysis was also credited to BlockSecTeam.

What actually happened

Rather than a contract-level exploit, the mechanism here was straightforward: Bent Finance's cvxCRV contract was modified on November 30, manually altering the balance recorded for the exploiter's address. This manual change credited the address with an enormous volume of rewards — far beyond Bent Finance's total value locked.

The manipulation went unnoticed for close to three weeks. It only surfaced once Bent Finance was listed on DeBank, at which point the exploiter's wallet profile displayed billions of dollars in pending rewards, drawing attention to the discrepancy.

Tracing the funds

Reviewing the primary wallet's token transaction history shows a series of small deposits followed by two large withdrawals: 263,000 cvxCRV-f on December 12, and another 250,000 cvxCRV-f on the day the incident was reported at 02:45 UTC.

The tokens were then moved to a secondary address controlled by the exploiter, converted to CRV, swapped for ETH, and routed through Tornado Cash. In total, 440 ETH (approximately $1.75 million) was laundered through Tornado Cash between December 12 and the day the exploit came to light.

Broader context

The role DeBank's listing played in surfacing this case — alongside Nansen's recent $75 million funding round — illustrates the growing importance of on-chain analytics tools in an increasingly complex DeFi landscape. While all the relevant data is technically public and traceable, these platforms significantly raise the odds that irregularities at lower-profile projects get caught.

Given the internal origin of the exploit and the team's response, this incident looks more like a possible rug pull or the actions of a rogue insider than an external hack. With larger exploits dominating headlines around the same period, an incident of this size risked being quickly overlooked.