Governance Attack on Hifi Finance: How to Check Your DeFi Collateral

At the DeFi protocol Hifi Finance, a previously unknown address gained control of the protocol's governance vote on 28 October 2026 and then drained user collateral worth around 1 million dollars, roughly 900,000 euros at the exchange rate of 29 October. The finding comes from the on-chain analyst Spreek, whose assessment underpins the day's reporting. Four votes, cast shortly before the end of an ongoing ballot, were enough. The same address then minted 25 million new governance tokens.

For investors in Europe, the pattern matters more here than the individual case. A governance attack needs no flaw in the program code that an audit might catch. It uses the voting rules themselves, and at many protocols those rules sit in the open, with no waiting period. Anyone who posts coins as collateral at a DeFi protocol carries that risk too, even if their own wallet is never touched.

What happened at Hifi Finance: four votes just before the ballot closed

Hifi Finance is a lending protocol on Ethereum. Users deposit assets as collateral and borrow against them at a fixed rate. Changes to the protocol are decided by a DAO, an organisation whose resolutions are reached by a vote of token holders and then executed automatically.

According to Spreek's account, the attacking address was funded through Tornado Cash, a service that obscures where transfers on the blockchain came from. Four transfers from that source supplied the address with voting weight. The votes landed in the closing phase of a ballot already under way, at a point when other holders could barely react. With the majority in hand, the resolution could be pushed through, and it permitted the minting of 25 million governance tokens. The collateral left the protocol after the resolution and after the minting.

Hifi Finance had not commented on the incident as of 29 October. All figures and sequences named here go back to Spreek's assessment and should be read as provisional; the project has not confirmed them so far.

25 million new tokens, 8,255 dollars in daily volume: the attacker's arithmetic

The 25 million freshly minted tokens sound like the bigger loss, and they are not. HIFI traded at 0.00132 dollars on 29 October, according to CoinGecko data. Total supply stands at around 141.98 million units. The 25 million newly minted tokens therefore amount to roughly 17.6 percent of the total supply.

On paper those tokens are worth about 33,000 dollars. Selling them at that size is another matter: trading in HIFI came to just 8,255 dollars over 24 hours. The minted amount is four times what changes hands in a whole day. A sale would have collapsed the price before any meaningful share had found a buyer.

That explains why the deposited collateral was the target and not the token. The minting served as the means to turn control of the protocol into access to other people's assets.

Whoever holds the majority of the votes sits at the protocol's control desk, even if they only arrived minutes ago.

RWA tokens as collateral: the real target of the outflow

The collateral that left the protocol consisted mostly of RWA tokens, according to the reports available. RWA stands for real world assets: tokens that certify a claim on a value outside the blockchain, on bonds, loans or property shares, for example.

These instruments are popular as collateral because their price moves more calmly than an altcoin's. That is exactly what makes them attractive to an attacker. A stolen altcoin loses value the moment someone tries to sell it; an RWA token with a stable underlying value is easier to turn into cash. Which assets a lending protocol accepts as collateral, and what conditions come with them, is set out in each provider's protocol terms.

Governance attack explained: how Tornado Cash money becomes voting power

A governance attack is the acquisition of voting weight in a DAO with the aim of pushing through a resolution of one's own. In the documented cases, several routes to that point can be distinguished.

The simplest is buying voting rights on the market. It works above all where the governance token is cheap but the assets under management are large. With a flash loan, the attacker takes out a loan that is drawn and repaid within a single transaction; for the moment of the vote it provides voting weight that never belonged to the attacker. The malicious proposal, finally, is a resolution whose wording reads harmlessly but whose executed code shifts rights. The Hifi Finance case is recorded under that heading in the registers. Added to this is the capture of dormant votes, tokens whose holders never delegated them and which tip the balance when turnout is low.

What all these routes share is that the protocol's program code works exactly as it was written. An audit that looks for errors in the code finds nothing here. How far that reaches was shown in August 2026 by the Term Finance case, which we covered under the question why audited code does not protect against governance exploits.

Three governance attacks in six days: X100, Yapeswap and Hifi Finance

The Hifi Finance case does not stand alone. A count of DefiLlama's public hack register, which records 1,328 incidents, shows eleven documented incidents across the crypto market for the seven days to 29 October 2026, three of them listed as governance attacks. All three fell within a window of six days. cryptoticker.io compiled this count itself on 29 October 2026.

24 October 2026, X100: 4.75 million dollars, recorded as a flash loan governance attack on Ethereum. On that case we described how a flash loan bought two of three senate seats. 25 October 2026, Yapeswap: 21,900 dollars, malicious proposal, also on Ethereum. 28 October 2026, Hifi Finance: malicious proposal on Ethereum. No loss figure has been entered in the register yet.

Over a longer period the picture loses some of its sharpness, but it stays clear. For the 90 days to 29 October 2026 the register lists seven governance attacks with losses totalling 22.58 million dollars, and over twelve months twelve cases with 47.9 million dollars. Three cases in six days therefore sit well above the average of those twelve months.

An older example shows that the size of the protocol plays no part in this: the BONK DAO lost 20 million dollars in July 2026 according to the same register data, without a hack in the usual sense.

HIFI price falls 25 percent: market capitalisation below 200,000 dollars

The token itself has reacted sharply to the events. HIFI gave up 25.4 percent within 24 hours and stood at 0.00132 dollars on 29 October 2026. That puts market capitalisation at 186,141 dollars. Measured against the all-time high of 2.63 dollars, reached on 16 September 2023, it is 99.95 percent short. All four values come from CoinGecko.

These numbers matter more for the assessment than they first appear to. A protocol whose governance token is worth less in total than an apartment manages collateral in the millions in the Hifi Finance case. The ratio between the price of control and the value of what is controlled is the real incentive to attack. Where a token is cheap and the managed assets are large, buying voting rights pays off.

Timelock and quorum: the two settings in every DAO vote

Two terms decide how open a vote is to attack. A timelock is a waiting period between a resolution and its execution; it gives the remaining holders time to notice a resolution and withdraw funds. A quorum is the minimum turnout a resolution needs in order to count.

The longer the timelock and the higher the quorum, the more expensive an attack becomes. Both cost agility, though: a protocol with a seven-day waiting period cannot respond to an emergency within hours. Protocols choose differently here, and the choice is publicly available to read. How Hifi Finance had set these values cannot be established from the material available; the project has not commented on it so far.

The protocol keeps running after the outflow, and the deposited assets are gone all the same.

MiCA and DeFi: no deposit protection for protocol collateral

Anyone in Europe who keeps coins with a supervised provider easily thinks of the protection schemes they know from their bank. None of that applies to a DeFi protocol. MiCA, the EU regulation on markets in crypto-assets, sets obligations for companies that hold, trade or issue crypto-assets commercially, and it requires a licence for doing so. A protocol without an operator, whose rules a DAO decides, is not such a company and in practice does not fall under those obligations.

That leads to three conclusions. There is no deposit protection for assets you hand to a protocol as collateral. There is no supervisory authority where you can report the loss and expect compensation. And the protocol is under no obligation to make good the damage; whether holders get anything back depends on the goodwill and the means of the DAO in question.

This is not an argument against DeFi, but it is an argument for a clear separation. Funds you do not want to lose do not belong in a protocol whose voting rules you have not examined.

Self-custody against protocol custody: where your coins actually sit

The decisive difference lies in the question of who holds the key. If coins sit in your own wallet, a governance attack on a protocol does not touch them. If you have deposited them as collateral, they are held by a contract whose rules are determined by a vote.

Both have their place. Without deposited collateral there is no loan and no yield from lending. The split should simply be a decision rather than a side effect. The part of your holdings meant to sit still belongs on a device you hold yourself; which devices are suited to that and what they cost is set out in our comparison of hardware wallets.

The pattern behind the cases: cheap votes, expensive collateral

What connects the three cases of the past week is no technical defect. It is a price ratio. Voting rights were cheaper to obtain than the value they command. As long as a governance token decays in price while the collateral sitting in the protocol holds its value, that ratio keeps shifting in an attacker's favour.

For judging a protocol, that means the market capitalisation of the governance token in relation to the assets under management is a figure investors should read just as closely as the interest rate. Both numbers are public.

DeFi collateral: three questions before your next deposit

How is the governance token valued against the assets under management? If the token's market capitalisation sits far below the collateral held in the protocol, buying voting rights is attractive on paper. Which providers set out terms and collateral openly is shown by the comparison of crypto lending providers. What waiting period lies between resolution and execution? Without a timelock a resolution takes effect immediately, and nobody can step in. If you are looking for yield inside a protocol, the terms of the individual providers are in the comparison of staking platforms. Which part of your holdings has to sit in the protocol at all? What is not meant to work needs no contract. It needs a key in your hand. The devices for that are in the comparison of hardware wallets.

A governance attack does not go after the wallet, it goes after the vote. At Hifi Finance, four votes in the closing phase were enough to mint 25 million tokens and move collateral worth around 1 million dollars. The token itself gave up 25.4 percent and is worth less in total than the collateral it commanded. Three such cases in six days suggest that this price ratio is currently being exploited systematically.

Reporting on the incident rests so far on a single on-chain assessment; a statement from the project is outstanding. The loss figure is therefore not yet solid, but the pattern already is.

(As of October 29, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Sources: DefiLlama, register of documented incidents and ChainCatcher on Spreek's on-chain assessment.