Hifi removes lending app after governance takeover

Hifi Finance has removed its lending interface from app.hifi.finance after a governance takeover left HIFI holders without effective control of the protocol’s governance contracts or token supply, according to two incident notices published by the project on October 29 and October 30.

The shutdown is the clearest operational consequence disclosed so far. Hifi said the attacker would retain the ability to install arbitrary code in the protocol’s Balance Sheet contract after a governance timelock expired. The team told users not to interact with that contract and said the application domain no longer hosts the Hifi interface.

The event matters beyond the protocol’s current size because governance was not merely advisory. Control of the voting system exposed an upgradeable contract and the token’s minting authority, showing how a successful vote can become a direct security boundary for decentralized finance.

What Hifi has confirmed

Hifi said on October 29 that the takeover should have been detected by its core team but was not stopped or reversed in time. It asked anyone with collateral in the protocol to withdraw immediately, removed DAO-owned liquidity from decentralized exchanges and stopped originating new debt.

The project estimated combined losses at approximately $20,000, while stressing that the final impact was still undetermined. It also said the DAO had enough resources to compensate affected users. Those are project estimates and commitments, not an audited loss statement or proof that reimbursement has been completed.

In its October 30 update, Hifi said approximately $14,000 of wrapped ether remained in the Balance Sheet contract and could be swept after the timelock expired. The notice identified a set of DSProxy contracts with standing WETH approvals, but said those contracts held no WETH at the time of its review. That snapshot does not eliminate future risk if funds are later sent to them.

Hifi also said existing debt backed by real-world assets would be managed directly by the core team, outside the compromised contracts. It expects that debt to be repaid in full on March 26, 2027. The statement did not disclose the debt balance, collateral valuation, borrower identities or legal arrangements supporting that expectation.

Outside estimates do not reconcile with Hifi’s figure

A November 1 incident review by blockchain-security provider Nominis dates the takeover to October 28. It says four late votes from Tornado Cash-funded addresses passed a malicious proposal, after which the attacker upgraded the Balance Sheet contract, minted 25 million HIFI and moved user collateral, mostly real-world-asset tokens.

Nominis assigned the incident an impact estimate of $1 million. That is materially higher than Hifi’s approximately $20,000 estimate. The opened records do not reconcile whether the larger figure describes gross collateral moved, assets still recoverable or controlled, or a different definition of realized loss. Coinburn therefore does not treat either number as a settled loss total.

Nominis placed Hifi among three governance attacks from October 24 through October 28 with a combined estimated impact of $5.9 million. That aggregate is the security firm’s event set and methodology, not a complete measure of all decentralized-finance losses during the period.

What remains unresolved

The project has promised a full report but had not published one in the records reviewed for this edition. The public notices do not establish the attacker’s identity, give a final accounting of affected assets or show that every exposed approval has been removed.

The strongest conclusion is narrower: Hifi’s own team says governance and contract control were lost, the user-facing app was withdrawn, and new lending has stopped. The financial impact remains disputed between the project’s estimate and outside transaction analysis, so any final loss or recovery claim requires a transaction-level reconciliation.