Hifi Finance Governance Attack Mints 25M HIFI, Drains $1M

Published October 29, 2026, 7:15 AM PKT. Based on on-chain researcher Spreek's findings as reported by ChainCatcher and carried by Binance News and Cointime on October 29, 2026 (primary and secondary sources below). This is the first MABOnChain article on the suspected Hifi Finance governance attack, and it is distinct from the October 23 coverage of the Initia network halt and the October 24 coverage of the X100 governance takeover.

DeFi lending protocol Hifi Finance is suspected of suffering a DAO governance attack in which an attacker minted 25 million HIFI tokens and transferred about $1 million in user collateral out of the protocol, according to on-chain researcher Spreek as reported by ChainCatcher. The attack, first carried in English-language crypto coverage in the early hours of October 29, 2026, follows a pattern that has now hit three protocols in a single week: control of a governance vote, a mint of new tokens, and a drain of user funds.

The sequence reported by Spreek starts with the vote itself. An address funded through Tornado Cash, the sanctioned coin mixer that obscures the trail of crypto funds, cast four votes near the end of a Hifi governance vote and took control of the protocol's governance, according to ChainCatcher's account of Spreek's findings, carried by Binance News and Cointime. Once in control, the address minted 25 million HIFI tokens and transferred all user collateral held by the protocol, valued at about $1 million, most of it in real-world-asset tokens, the reports said.

Four votes at the end of the ballot

The detail that makes this attack different from a straightforward exploit is its timing. The four votes landed just before the governance vote was about to conclude, according to Cointime's account, which left no window for other token holders or the Hifi team to respond before control changed hands. Governance votes are supposed to be the safeguard that stops any single party from rewriting a protocol's rules, so an attacker who can win a vote late, with funds routed through a mixer, turns the safeguard itself into the weapon.

What the reports do not yet establish is equally important. They do not name the governance proposal at issue, they do not say whether the minted HIFI tokens were sold, and they do not report any recovery or freezing of the drained collateral. Hifi Finance had not published a public statement on the incident in the coverage reviewed at the time of publication, which means the $1 million figure and the 25 million token count remain researcher estimates rather than protocol-confirmed totals. Readers should treat both numbers as preliminary until Hifi or an independent security firm confirms them on chain.

25 million HIFI and about $1 million in collateral

The two numbers describe two different kinds of damage. The 25 million HIFI tokens are newly minted governance tokens, created by the attacker after taking control, which dilutes existing holders and hands the attacker a commanding voting position if the tokens remain in circulation. The roughly $1 million is the user collateral the reports say was transferred out of the protocol entirely, and the fact that most of it was in real-world-asset tokens matters: RWA tokens represent claims on off-chain assets, so their loss raises questions about redemption and backing that a plain crypto drain does not.

The use of Tornado Cash funding for the voting address is the other telling detail. It matches the laundering route seen in the X100 case days earlier, where the attacker later moved funds into the same mixer, and it complicates any attempt to identify who cast the votes. Mixer funding does not prove who the attacker is, and the reports reviewed do not attribute the attack to any person or group.

Governance takeovers keep repeating

Hifi is the third protocol in a week to face this class of attack. On October 24, 2026, the X100 protocol suffered a flash-loan governance takeover that drained about $4.85 million and crashed its token about 96%, an incident MABOnChain covered at the time, and the X100 attacker later moved 821.2 ETH, worth about $1.89 million, into Tornado Cash, according to October 26 reports citing PeckShield. On October 23, 2026, the Initia layer-1 blockchain halted its chain and rollups after Spreek flagged an exploit that minted tokens without authorization and cashed out about $2.6 million, a case in which the same researcher supplied the first public estimate.

The older precedent is Tornado Cash itself. In 2023, an attacker seized control of the mixer's DAO through a malicious governance proposal, created more than 1 million fake votes and stole about $1.5 million before eventually returning governance control to the community. The lesson of that case, repeated in the Hifi reports, is that governance contracts need the same adversarial scrutiny as vaults and bridges: a vote that can be bought late, with borrowed or mixer-funded tokens, is a vault door with a second key.

What remains unconfirmed

Three questions decide how serious this incident becomes. First, whether Hifi confirms the attack and publishes its own accounting of what was minted and drained. Second, whether any of the collateral can be frozen or recovered, which depends on where the funds moved after leaving the protocol, a trail the current reports do not follow. Third, whether the minted HIFI tokens stay in the attacker's hands, which would leave the protocol's governance compromised even after the drain itself is over.

Until Hifi speaks, the practical position for users is caution: the reports describe a protocol whose governance was taken over and whose user collateral was emptied, and no source reviewed for this article reports a fix, a pause, or a recovery. MABOnChain will update this story if Hifi publishes a statement or if security researchers revise the figures.

This article is news reporting and is not investment advice.

Sources

• Binance News, Hifi Finance Suspected of Governance Attack as 25 Million HIFI Tokens Are Minted (October 29, 2026), primary source (carries ChainCatcher's account of on-chain researcher Spreek's findings)
• Cointime, Hifi Finance Suspected of Governance Attack, Issues 25 Million HIFI (October 29, 2026), secondary source
• BBX, Real-Time Crypto News Flash: Hifi Finance DAO governance power grab (October 29, 2026), secondary source