HopeLend was exploited via a precision loss vulnerability in hToken's share calculation during the _handleFlashLoanRepayment function. The attacker minted tiny PEPE shares, donated large volumes to distort the exchange rate, then borrowed ETH using rounding errors in the redeemUnderlying function.

On October 18, 2023, , the HopeLend protocol fell victim to a hacker attack. The attack resulted in a loss of approximately 528 ETH, out of which 263.91 ETH were bribed by the frontrunner to a Validator (managed by Lido). The exploit frontrunner eventually profited by 264.08 ETH. On October 20, Hope.money tweeted that a frontrunner from Armor Team voluntarily returned the acquired assets.