Summary so far

USDС was drained from the Impossible Finance DEX’s USDС/WeHMND pair.

The cause was a misconfiguration on the Impossible Finance end. Operational error, that triggered a known issue by incorrect pool configuration.

No issues with Humanode consensus or EVM implementation.

Currently, the funds are recovered, and we will be placing them accordingly.

Remediation strategy

• pause funds at bridges we were unable to do this in time
• reach out and try to do a bounty deal
• explore other options; ultimately we will restore the funds to the users

Timeline (UTC)

• 2023-12-01 07:29 - configuration update at Impossible Finance USDC/WeHMND pair
• 2023-12-01 10:48 - USDC was withdrawn from the IF USDC/WeHMND pair
• 2023-12-01 10:50 - team members noticed the event
• 2023-12-01 10:54 - partners notified about the incident
• 2023-12-01 10:59 - team brought up for investigation
• 2023-12-01 11:05 - chain integrity confirmed, the cause of withdrawal determined
• 2023-12-01 11:07 - USDC bridged out from Humanode chain to Ethereum
• 2023-12-01 11:16 - tactical communication started with Impossible Finance
• 2023-12-01 11:38 - ChainPort freezes Humanode chain bridge
• 2023-12-01 12:05 - first contact with the party behind the withdraw