Someone found a bug in BiFi's lending market. An MEV bot copied the attack 12 seconds later and got there first.
BiFi's Ethereum USDT market sat idle for 36 days. Its interest code then re-charged that whole gap on every action in a block, at a rate the caller could pump. On Oct 17 an address deployed an exploit contract. One block later, MEV operator c0ffeebabe.eth ran the same trick from its own contract on a 40.5M USDT Morpho flash loan and drained 165,575 USDT.
About 36 hours later it sent back 159,103.65 USDC. The ~$6.5K gap is a block-builder tip plus ETH's price move. Within eight minutes, address poisoners were dusting it with BiFi lookalikes. BiFi still hasn't posted a postmortem.
The security model was "hope the fastest bot is polite." It was, this time.
Source: https://sigintzero.com/blog/bifi-165k-idle-market-interest-accrual