Is Abracadabra Under a Curse? Another Major DeFi Hack Results in $1.8 Million Loss

The DeFi lending platform Abracadabra has been targeted in yet another attack, resulting in an approximate loss of $1.8 million worth of MIM tokens. This incident marks the third significant security breach impacting the platform this year, raising serious concerns about its contract security.

Key Takeaways

Abracadabra lost around $1.8 million in MIM tokens due to a hack exploiting a flaw in its “cook” function.
The platform's team previously recovered half of a $13 million loss from a March exploit.
Security analysis revealed that this latest attack did not stem from typical vulnerabilities but from a logical error in the coding.
Experts suggest implementing more security checks to prevent similar incidents in the future.
2025 is proving to be one of the most challenging years for DeFi security, with increased exploits affecting multiple platforms.

Is Abracadabra Cursed? Third Major DeFi Hack This Year Siphons Another $1.8M

The Latest Abracadabra Exploit

DeFi lending protocol Abracadabra has suffered another exploit, losing around $1.8 million in MIM tokens. This sophisticated attack took advantage of a flaw in its “cook” function, highlighting ongoing security concerns for the platform. Previously, in May, the protocol had repurchased 6.5 million MIM to recover about half of a $13 million loss from a March incident. The developers reassured users that their funds remain safe and part of the $19 million treasury was used to stabilize the MIM supply.

.@MIM_Spell was attacked hours ago, resulting in a loss of ~$1.7M. The root cause stems from the flawed implementation logic of the cook function, which allows users to execute multiple predefined operations in a single transaction. Specifically, the actions share a common… pic.twitter.com/4tQzkRbwcT — BlockSec Phalcon (@Phalcon_xyz) October 4, 2025

Blockchain data indicates that the attacker exploited the same flaw across six different wallet addresses. By executing the “cook” function with a specific action sequence, the hacker borrowed 1,793,755 MIM tokens and later exchanged them for other assets, ultimately gaining about $1.7 to $1.8 million.

Security analysts clarified that the vulnerability was not due to a reentrancy bug or a flash loan issue but was a straightforward logical error in the code. The compromised transaction and wallets have been flagged by monitoring services.

The Abracadabra team stated that the DAO has identified and remedied the exploit, assuring that no additional user funds are at risk.

On Saturday, a security vulnerability was discovered that affected some V4 deprecated cauldrons on Ethereum mainnet. During the attack, 1.79m MIM were minted by the attacker. Shortly after, the DAO Treasury identified and mitigated the vulnerability, confirming no other… — 🧙🏼‍♂️ (@MIM_Spell) October 6, 2025

Early recommendations from security professionals include establishing isolated state checks for each action and mandatory solvency tests post-borrowing operations.

Understanding the Vulnerable “Cook” Function

According to the blockchain security company BlockSec, the exploit targeted Abracadabra’s “cook” function. This feature allows users to execute multiple predefined operations within a single transaction. While this design goal was efficiency, it inadvertently created a significant vulnerability due to shared status tracking between actions.

Each action under the “cook” function shares a common status variable. When a borrowing action occurs, it sets a flag for a necessary solvency check after the transaction. However, if another action follows, it triggers a helper function, “additionalCookAction,” which is essentially empty and resets the solvency flag to false, overriding prior settings.

This coding mistake allowed the attacker to combine the two actions to borrow assets while circumventing the solvency check. Consequently, the final solvency verification went unexecuted, enabling the attacker to drain funds from the protocol.

Analysts emphasize that as DeFi platforms focus increasingly on flexibility and composability, attackers are becoming more skilled in discovering overlooked dependencies within complex smart contract logic. Therefore, enhancing testing frameworks, code reviews, and continuous monitoring are essential steps to safeguard protocols and user funds.

The Rising Wave of DeFi Hacks in 2025

The decentralized finance (DeFi) sector is encountering one of its most challenging years, with a record increase in exploits in 2025. Abracadabra itself experienced a $13 million breach on March 25, 2025, following attackers exploiting deep-seated logic flaws within its smart contracts.

🔒 https://t.co/MbOCK0J3eL suffers a $13M ETH security breach, targeting @GMX_IO -linked pools, marking its second major exploit this year after a $6.49M hack in January. #DeFi #CryptoHack — Cryptonews.com (@cryptonews) March 25, 2025

The attack concentrated on GMX token pools and drained 6,260 ETH. Unlike common vulnerabilities rooted in arithmetic or access control mistakes, this incident utilized complex multi-step transaction logic, making it challenging to detect during audits.

This event was Abracadabra’s second attack of the year, following a $6.49 million incident in January that destabilized its Magic Internet Money (MIM) stablecoin, implicating several “cauldrons” on Ethereum.

🥷🏽🔐 Abracadabra Money in Crisis as $6.5 Million Crypto Theft Sends Shockwaves Across DeFi Community — Popular Ethereum-based DeFi lending protocol Abracadabra Money fell victim to a platform attack on January 30. #CryptoNews #news — Cryptonews.com (@cryptonews) January 31, 2024

Blockchain investigators later discovered that the hacker utilized 1 ETH from Tornado Cash to finance the operation, ultimately siphoning off 2,740 ETH and relocating $4 million to a new wallet.

The Abracadabra exploit is part of a broader trend reflecting escalating crypto thefts. Research from Chainalysis reveals that over $2.17 billion was stolen between January and June 2025, nearly matching the total losses of 2024. CertiK estimates this figure even higher at $2.47 billion, driven mainly by February's $1.5 billion Bybit breach—one of the largest exchange hacks in history.

In terms of monthly losses, hacks accounted for approximately $127.06 million in September 2025. While this marked a 22% reduction from August's $163 million, nearly 20 major exploits were still documented. Despite the decline, exploit activities are prevalent, with September losses surpassing July's $142 million.

🇨🇭 SwissBorg hit by $41.5M $SOL hack after API compromise amid a wave of crypto security failures. #CryptoHack #Solana — Cryptonews.com (@cryptonews) September 8, 2025

With mid-year losses for 2025 already exceeding the total of $2.2 billion stolen in all of 2024, experts caution that without enhanced security measures, this year could be among the worst in cryptocurrency history for breaches.