On June 17, 2023, Midas Capital's HAY/BUSD pool on BSC was exploited for $340K-$600K via a rounding error in cToken redemption logic. The attacker crafted positions that rounded down to 1 wei, repeatedly exploited the error with minimal deposits and flash-loaned ANKR collateral to withdraw disproportionately large sums.

Cross-chain money market solution Midas Capital has been hacked, causing losses of more than $600,000 after an integer rounding problem in its lending protocol (derived from a fork of the well-known Compound Finance v2 codebase) was exploited. The same situation was also exploited in the previous attack on Hundred Finance. The attacker deposited 400 BNB into Tornado Cash, and some other proceeds were bridged to Ethereum.