What happened
On November 10, 2022, DFX Finance's V2 stablecoin pools were drained through a flash-loan exploit: the attacker borrowed pool liquidity, deposited it back as collateral and withdrew the pool's real assets before repaying the loan. In a twist that defined the incident, a front-running MEV bot spotted the attacker's pending transaction and replayed it first — netting more than the attacker did. ChainHint's trace maps both flows through Curve and Uniswap V3 pools; its largest single endpoint, on both the historical and the current valuation, is an address our labels carry as Tornado Cash.
How the funds moved
Flash-loan Exploit
The attacker flash-borrowed liquidity from DFX's dfx-xidr-v2 pool, cycled it through deposit() as collateral, and withdrew the pool's underlying tokens before the loan settled — a textbook reentrancy-style accounting flaw.
MEV Front-run
A generalized front-running bot detected the exploit transaction in the mempool and executed the same attack one position earlier in the block — capturing ~$3.3M, more than the original attacker's ~$1.2M take. ChainHint's graph shows both flows as separate endpoints.
DeFi Dispersal
Proceeds moved through Curve and Uniswap V3 pools and fanned out across fresh wallets. The largest endpoint on either valuation is an address our labels carry as Tornado Cash.
Where the funds went
Read from the transfers in ChainHint's trace, not from press reports
ChainHint's trace of the DFX Finance hack follows 892 transfers across 166 addresses and 6 hops, between Nov 10, 2022 and Aug 25, 2026. The first hop out of the attacker's address moved ETH ($3.28M), USDC ($2.09M). 7 of the transfers are DEX swaps.
Visualized attack path
166 addresses · 892 transfers · Traced with ChainHint
Key findings
Labeled Exploiter
Front-running Bot
Protocol Response
Investigate your own incident
ChainHint traced the DFX Finance hack in minutes.
Use the same tool for your case.