Ionic Money (formerly Midas): Fake Collateral Listing (Social Engineering → On-chain Exploit)

Summary #

Ionic Money (formerly Midas) suffered a Lending / Money Market on 2024-02-04, resulting in a loss of approximately $7M.

What happened #

Ionic Money lost $6.9M when attackers impersonating the Lombard Finance team convinced the protocol to whitelist a counterfeit LBTC token as collateral, then minted 250 fake tokens, borrowed everything in Ionic's vaults, and vanished through Tornado Cash.

Linked factors #

• RD-F-001 — causal : ★ Audit scope mismatch — alternate field name [via dashboard_risk_factors/Exploited code in scope?: No — the exploit was via social engineering to whitelist fake collateral; the smart contract code itself was not bugged]
• RD-F-006 — causal : Audit-deploy gap — alternate field name [via dashboard_risk_factors/Code newly deployed/upgraded?: New collateral listing (governance/admin action)]
• RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
• RD-F-027 — causal : ★ Single admin EOA — when value mentions key compromise [via realtime_signals/Governance/admin action (Y/N): Y — admin whitelisting of fake collateral was the enabling action]
• RD-F-101 — illustrative : Large governance proposal queued — RT signal would have fired [via realtime_signals/Governance/admin action (Y/N): Y — admin whitelisting of fake collateral was the enabling action]
• RD-F-126 — causal : Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Midas was a lending protocol; architecture similar to Compound forks]
• RD-F-127 — related : Upstream Compound has patches that may not be merged here [via dashboard_risk_factors/Forked?: Yes — Midas was a lending protocol; architecture similar to Compound forks]