BiFi Security Reports Detail USDT Market Exploit and $159K Return

Security researchers reported an exploit affecting BiFi's USDT lending market on Ethereum, with around 165,600 USDT extracted. A follow-up report said the front-running bot returned 159,103 USDC to the market contract at 17:21 UTC on October 18, 2026. Follow incident coverage in OrangeX.com Security.

Interest accounting after an inactive period

The technical report linked the exploit to interest-calculation logic after roughly 36 days of market inactivity. Repeated actions within one block could reuse that long accrual interval while the interest rate changed with utilization, inflating the interest available for withdrawal.

Researchers said a bot known as c0ffeebabe.eth executed ahead of the original attacker. The follow-up characterized its action as a white-hat recovery. That description and the reported return should be distinguished from a project-issued final accounting or independent confirmation that every user has been made whole.

A return is not a final net-loss calculation

The extracted amount was reported in USDT and the returned amount in USDC. Subtracting the token counts does not establish a final dollar loss without reconciling conversions, costs and remaining balances. Neither a reported return nor a successful intervention proves that every affected contract is patched or safe to reuse. More coverage is available in OrangeX.com News, with verification resources in the OrangeX.com Trust Center.

OrangeX.com Analysis

The case highlights time-dependent accounting risk in quiet lending markets. Testing should cover long idle periods followed by multiple actions in one block, not only routine activity. Recovery progress, root-cause remediation and user reimbursement are separate questions. Later project disclosures and reconciled transactions will be needed to assess the final outcome.