Abracadabra Defi Lending Protocol Faces Third Major Hack in 2025, Losing $1.8 Million
Defi lending protocol Abracadabra has fallen victim to another sophisticated attack, resulting in a loss of approximately $1.8 million in MIM tokens. This exploit marks the third major hack connected to Abracadabra this year, raising concerns about the platform’s contract security.
The attack utilized a mistake in the “Cook” function, which allows users to perform multiple predefined operations in a single transaction. According to Blockchain Security Firm Blocksec, the attacker borrowed 1,793,755 MIM tokens and later exchanged them for other assets, achieving a total gain of around $1.7 to $1.8 million.
The Abracadabra development team confirmed that the DAO identified and mitigated the exploit, and no other users are at risk. Security analysts recommend implementing isolated state reviews for every action and adding mandatory solvency validations after all borrowings to prevent similar attacks in the future.
How the Flawed “Cook” Function Was Exploited in the Abracadabra Hack
The “Cook” function in Abracadabra’s smart contract allowed users to perform multiple predefined operations in a single transaction. However, due to the shared status tracking within the function, it created a security vulnerability. The attacker combined two actions, [5, 0], to borrow assets and avoid the solvency check, resulting in the protocol’s funds being drained.
Analysts warn that Defi platforms continue to prioritize flexibility and composition, making it easier for attackers to identify overlooked dependencies within complex smart contract logic. Strengthening test frameworks, improving code reviews, and implementing continuous monitoring are essential steps to protect protocols and user funds.
Defi Hacks on the Rise in 2025
The decentralized finance (Defi) space is facing one of its toughest years, with exploits recording the highest numbers in 2025. According to Chainalysis, over $2.17 billion was stolen between January and June 2025, almost matching the total loss of 2024. Certik estimates the number to be even higher, at $2.47 billion, largely driven by the $1.5 billion BYBIT hack.
Abracadabra’s attack is part of a wider trend of escalating cryptodirectory. The protocol suffered an ether (ETH) hack earlier this year, which emptied 6,260 ETH from GMX token pools. The attack used a multi-stage transaction logic, making it extremely difficult to recognize during audits.
As the losses in 2025 have already exceeded the $2.2 billion stolen in 2024, analysts warn that this year could be one of the worst in the history of crypto due to hacks. For more information, visit https://cryptonews.com/news/is-abracadabra-cursed-third-major-defi-hack-this-year-siphons-another-1-8m/
