Attack on Hifi Finance governance moves nearly $1 million in user collateral
Key Facts
On-chain researcher Spreek disclosed that nearly $1 million in user collateral had been moved from the Hifi Finance protocol following a takeover of the decentralized autonomous organization’s governance, according to a report published by TokenPost on October 28, 2026. SlowMist’s record estimated the losses at nearly $1 million and said most of the transferred collateral consisted of tokens linked to real-world assets. After taking control of the vote, the attacker minted 25 million governance tokens and transferred collateral deposited on behalf of users. That puts the organization’s decision-making mechanism at the center of the incident: the vote enabled a measure that allowed the contract to be changed and the assets then moved.
According to TokenPost’s report, four funding transfers through Tornado Cash preceded the vote, which took place in the final moments and shifted control to the attacker. SlowMist’s record identified the proposal as Proposal 21 and said the attacker updated the BalanceSheet contract after it passed and before withdrawing the collateral. The sequence describes a shift from gathering votes to changing the contract and then moving assets, rather than merely minting governance tokens. The 25 million figure refers to the number of governance tokens minted, while the loss estimate concerns the value of the transferred collateral. The number of tokens minted therefore does not mean the withdrawn assets were worth the same amount.
Hifi’s documentation states that the voting period for a proposal lasts five days, after which an approved proposal enters a two-day Timelock waiting period before it can be executed. The documentation also requires a majority vote and support equivalent to at least 2% of HIFI’s supply for a proposal to pass. Under the protocol’s stated mechanism, the waiting period provides time between a proposal’s approval and execution. In this incident, SlowMist’s record said the attacker passed Proposal 21 and then updated the BalanceSheet contract before moving the collateral. The incident highlights how voting and execution rules intersect with the permissions of contracts that control users’ assets.
Hifi’s official collateral page lists assets linked to commercial and residential real estate, medical equipment and vehicles among the accepted collateral categories. SlowMist’s record said most of the collateral transferred in the incident consisted of real-world asset tokens, linking the impact to assets beyond conventional digital tokens. An initial plan put forward by Hifi in April 2025 proposed allocating 800,000 USDC to core services through March 27, 2026. The plan also included allocations of 200,000 USDC and $200,000 in HIFI tokens for liquidity in the HIFI/USDC pair. These proposals provide background on funding for the protocol’s services and liquidity before the attack.
In December 2025, Hifi said rejecting an extension of the initial plan would lead to the organization’s closure and put the protocol into withdrawal-only mode, while proposing to extend the plan through the end of March 2027. During discussion of the proposal, a team representative said outstanding loans were healthy and that no delinquencies or bad debt were expected. The representative added that 25 million HIFI tokens from an earlier proposal would be burned whether the plan was extended or the protocol closed. In an earlier development concerning the token’s exchange trading, Binance announced it would delist HIFI spot pairs and halt trading on September 17, 2025, at 03:00 UTC. The information available here does not include verified figures for HIFI’s price movement or trading volume after the governance incident.