Pike Finance Hit Twice in Four Days as the Same Storage Bug Drains $1.9M Across Three Chains

Pike Finance, a cross-chain lending market that lets users borrow and lend native assets directly on their home blockchains without wrapping or bridging them, was exploited twice within the space of four days in late April 2024, losing a combined total of more than $1.9 million.

Pike's pitch is a "universal liquidity market" — a single protocol spanning multiple chains that avoids the wrapped-asset and bridging risks common to cross-chain lending. That architecture is also what let one underlying flaw be exploited more than once.

The first breach: April 26, Arbitrum

According to Pike Finance's own account of the incident, the root cause traced back to insufficient security checks in the functions handling CCTP (Circular Cross-Chain Transfer Protocol) transfers. While the team was in the process of attempting to pause the protocol, an additional dependency introduced into the code shifted the contract's storage layout and displaced the "initialized" variable, throwing the contract into an unintended state.

An attacker seized on that misconfiguration to upgrade Pike's spoke contracts without holding admin privileges, then drained funds through the compromised implementation. The underlying flaw let the attacker re-initialize the upgraded implementation contract and claim owner permissions for themselves — effectively taking control of a contract they had no rights to touch.

Pike Finance had already acknowledged this initial attack days earlier, following a separately reported USDC-related vulnerability. But the fix — or lack of one — left the door open for a repeat performance.

The second breach: April 30, three networks at once

On April 30, Chain Aegis flagged a fresh attack, this time spanning Ethereum, Arbitrum, and Optimism simultaneously, and pulling out more than $1.6 million in ARB, OP, and ETH. Pike confirmed the incident shortly after.

Per analysis from Quill Audits, both the April 26 and April 30 incidents stemmed from the identical smart-contract weakness, allowing the attacker to override contract logic on each occasion. The mechanics broke down as follows:

• The attacker called the initialize function on the original contract and inserted their own address into the _isActive variable.
• Because the initializer functions lacked proper access protection, the attacker was able to sidestep the safeguards meant to stop them from being run more than once.
• By manipulating version numbers, the attacker used up and locked out otherwise-reusable version slots, which let them trigger fresh initialization steps with every subsequent upgrade.
• Finally, the attacker called upgradeToAndCall to push through a malicious implementation, completing the takeover.

On-chain trail

April 26 attack (Arbitrum):

• Attacker: 0xAdaF1626aEC26A7937aE7d1Fa0664e6E0904C1d0
• Target contract: 0x7856493B59cdb1685757A6DcCe12425F6a6666a0
• Attack transaction: 0x979ad9b7f5331ea8034305a83b5cd50aea88adec395fff8298dd90eb1b87667f

April 30 attack (multiple networks):

• Attacker: 0x19066f7431df29a0910d287c8822936bb7d89e23
• Attack contract: 0x1da4bc596bfb1087f2f7999b0340fcba03c47fbd
• Target contract: 0xfc7599cffea9de127a9f9c748ccb451a34d2f063
• Optimism transaction: 0x19066f7431df29a0910d287c8822936bb7d89e23
• Arbitrum transaction: 0x19066f7431df29A0910d287C8822936Bb7D89E23
• Ethereum transaction: 0xe2912b8bf34d561983f2ae95f34e33ecc7792a2905a3e317fcc98052bce66431

Security posture, and the money on the table

At the time of the exploits, Pike Finance had no completed public audit and no live bug bounty program — both sections of its documentation were still marked "coming soon." Its contracts page also had not been updated to reflect mainnet deployments, still listing only testnet addresses.

The protocol had raised $6.45 million from a community presale of its native PIU token at the end of March 2024. Following the April 26 attack, the team sent an on-chain message to the exploiter, and after the April 30 incident it offered a 20% bounty for the return of funds or information leading to their recovery, along with a promise of a fuller incident report and a reimbursement plan at a later date.

Responses to Pike's exploit announcement show many presale participants asking whether their contributions were safe; those funds are reported to be unaffected so far.

Taken together, the back-to-back incidents highlight how an unresolved architectural flaw — rather than two unrelated bugs — allowed a single class of vulnerability to be exploited repeatedly across different chains before it was contained.