BiFi Security Reports Detail USDT Market Exploit and $159K Return
Security reports described a BiFi interest-calculation exploit extracting about 165,600 USDT, followed by a reported return of 159,103 USDC on October 18.
Security researchers reported an exploit affecting BiFi's USDT lending market on Ethereum, with around 165,600 USDT extracted. A follow-up report said the front-running bot returned 159,103 USDC to the market contract at 17:21 UTC on October 18, 2026. Follow incident coverage in OrangeX.com Security.
Interest accounting after an inactive period
The technical report linked the exploit to interest-calculation logic after roughly 36 days of market inactivity. Repeated actions within one block could reuse that long accrual interval while the interest rate changed with utilization, inflating the interest available for withdrawal.
Researchers said a bot known as c0ffeebabe.eth executed ahead of the original attacker. The follow-up characterized its action as a white-hat recovery. That description and the reported return should be distinguished from a project-issued final accounting or independent confirmation that every user has been made whole.
A return is not a final net-loss calculation
The extracted amount was reported in USDT and the returned amount in USDC. Subtracting the token counts does not establish a final dollar loss without reconciling conversions, costs and remaining balances. Neither a reported return nor a successful intervention proves that every affected contract is patched or safe to reuse. More coverage is available in OrangeX.com News, with verification resources in the OrangeX.com Trust Center.
OrangeX.com Analysis
The case highlights time-dependent accounting risk in quiet lending markets. Testing should cover long idle periods followed by multiple actions in one block, not only routine activity. Recovery progress, root-cause remediation and user reimbursement are separate questions. Later project disclosures and reconciled transactions will be needed to assess the final outcome.
Related Reports
Project Eleven and Relm Study Quantum Readiness in Crypto Insurance
Relm will advise on Strongpoint custody controls. The exploratory partnership does not establish premium discounts or new insurance coverage.
Qubic Reports 1,404 Wallets Drained Through Weak Seed Generation
Qubic linked a 1,404-wallet drain to insufficient seed randomness. Its October 18 update reported a protective halt and a seed-generation fix in v4.26.4.
SEAL Reports 81 Weekly Incidents as Fake Support Risks Persist
SEAL’s October 6–13 report records 81 incidents and 6,109 phishing domains. The figures describe its response dataset, not all crypto crime.
