🚨 Hack Alert!
Target: StakeDAO
What happened: An ongoing exploit has been detected targeting StakeDAO on the Arbitrum chain. The attacker has minted over 5.4 trillion vsdCRV tokens and is currently swapping them for ETH.
This incident highlights the vulnerabilities present in the platform and the active measures being taken to address the situation.
🔗Tweet URL: View Tweet
Target: StakeDAO
What happened: An ongoing exploit has been detected targeting StakeDAO on the Arbitrum chain. The attacker has minted over 5.4 trillion vsdCRV tokens and is currently swapping them for ETH.
This incident highlights the vulnerabilities present in the platform and the active measures being taken to address the situation.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: LegendaryMoneyMonNft
What happened: 🚨 A hack has been reported involving the
💸 Total loss amounts to 85,519.47 USDT.
🔍 The root cause of the exploit was identified in the
📌 The attacker exploited this vulnerability using an invalid signature (
📌 Attacker Address: 0xe1582248c593df4b367e131922438fec9d76e787
📌 Victim Contract Address: 0x92d60629ff5d53a0098b51e9b1d59546d1d8e5b6
📌 Vulnerable Contract Address: 0x92d60629ff5d53a0098b51e9b1d59546d1d8e5b6.
The attacker drained tokens from the contract and subsequently swapped them for USDT via PancakeSwap.
🔗Tweet URL: View Tweet
Target: LegendaryMoneyMonNft
What happened: 🚨 A hack has been reported involving the
LegendaryMoneyMonNft contract. 💸 Total loss amounts to 85,519.47 USDT.
🔍 The root cause of the exploit was identified in the
cliamRewred function, which allowed arbitrary reward claiming. The authorization relied on verify(), which checks that recoverSigner(...) == admin. However, recoverSigner failed to validate ecrecover returning address(0), and the changeadmin() function permitted setting the admin to a zero address. 📌 The attacker exploited this vulnerability using an invalid signature (
r=0, s=0, v=27), enabling them to pass the authorization check because the admin was set to the zero address momentarily. 📌 Attacker Address: 0xe1582248c593df4b367e131922438fec9d76e787
📌 Victim Contract Address: 0x92d60629ff5d53a0098b51e9b1d59546d1d8e5b6
📌 Vulnerable Contract Address: 0x92d60629ff5d53a0098b51e9b1d59546d1d8e5b6.
The attacker drained tokens from the contract and subsequently swapped them for USDT via PancakeSwap.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: ONTR
What happened: A security incident was reported by SlowMist involving the ONTR token contract.
Loss amounted to 49.4801 WETH, approximately $98,315.16.
The root cause was an access control vulnerability in the
Following the exploit, the attacker executed a sequence of calls:
The stolen funds were transferred and swapped for real WETH via PancakeSwap.
Attacker's address: 0xe806b37a9f965bd9d54aadf9560c78957550b760.
Victim pair address: 0xd46d89f4675bc96328fbdeb443842cdb5fcd83fd.
Vulnerable contract address: 0xf074865358b0dd039beee075831f8a2ae6b1f3f3.
🔗Tweet URL: View Tweet
Target: ONTR
What happened: A security incident was reported by SlowMist involving the ONTR token contract.
Loss amounted to 49.4801 WETH, approximately $98,315.16.
The root cause was an access control vulnerability in the
onlyOwner modifier of the ONTR token contract. Due to the owner address being set to zero, any address could bypass checks. The attacker exploited this by changing ownership to their contract through transferOwnership().Following the exploit, the attacker executed a sequence of calls:
desertJasper() added a hidden balance, and glenFlash() executed ashBud(), resulting in a massive balance increase without affecting total supply.The stolen funds were transferred and swapped for real WETH via PancakeSwap.
Attacker's address: 0xe806b37a9f965bd9d54aadf9560c78957550b760.
Victim pair address: 0xd46d89f4675bc96328fbdeb443842cdb5fcd83fd.
Vulnerable contract address: 0xf074865358b0dd039beee075831f8a2ae6b1f3f3.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Alephium TokenBridge
What happened: 🚨 An exploit targeting the Alephium TokenBridge on Ethereum has been reported. Approximately $815K was drained in about 7 minutes due to the compromise of 3 out of 4 guardian keys, which were used to sign forged VAAs. This resulted in the minting of 13.76M wrapped ALPH, exceeding 100% of the prior supply. Additionally, USDT, USDC, WBTC, and WETH were unlocked from custody. More details are available in the following thread.
🔗Tweet URL: View Tweet
Target: Alephium TokenBridge
What happened: 🚨 An exploit targeting the Alephium TokenBridge on Ethereum has been reported. Approximately $815K was drained in about 7 minutes due to the compromise of 3 out of 4 guardian keys, which were used to sign forged VAAs. This resulted in the minting of 13.76M wrapped ALPH, exceeding 100% of the prior supply. Additionally, USDT, USDC, WBTC, and WETH were unlocked from custody. More details are available in the following thread.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: TesseraDao
What happened: A significant exploit has been reported involving TesseraDao on the BNB Chain.
Approximately 99 million $TSR tokens were minted and subsequently dumped, resulting in a 99% decrease in value.
The exploiter converted the $TSR into around 2.5 million $USDT and transferred the stolen funds to Ethereum. Further laundering of 1,285.5 $ETH was executed using Tornado Cash.
This incident highlights a major security breach in an established project, leading to substantial financial loss.
🔗Tweet URL: View Tweet
Target: TesseraDao
What happened: A significant exploit has been reported involving TesseraDao on the BNB Chain.
Approximately 99 million $TSR tokens were minted and subsequently dumped, resulting in a 99% decrease in value.
The exploiter converted the $TSR into around 2.5 million $USDT and transferred the stolen funds to Ethereum. Further laundering of 1,285.5 $ETH was executed using Tornado Cash.
This incident highlights a major security breach in an established project, leading to substantial financial loss.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: New Market Trading
What happened: New Market Trading experienced a significant loss of $3.78 million in just 15 minutes due to a security incident.
The attack resulted in 88 Safes being drained across Ethereum, Base, and Arbitrum.
Notably, there was no flash loan or bridge exploit involved. The attacker exploited a vulnerability by reading a public contract, copying a delegate address, and invoking an unguarded function.
The recommended fix for this vulnerability was quite simple, requiring only one line of code:
require(msg.sender == delegate);
🔗Tweet URL: View Tweet
Target: New Market Trading
What happened: New Market Trading experienced a significant loss of $3.78 million in just 15 minutes due to a security incident.
The attack resulted in 88 Safes being drained across Ethereum, Base, and Arbitrum.
Notably, there was no flash loan or bridge exploit involved. The attacker exploited a vulnerability by reading a public contract, copying a delegate address, and invoking an unguarded function.
The recommended fix for this vulnerability was quite simple, requiring only one line of code:
require(msg.sender == delegate);
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: gravitybridge
*What happened:* 🚨 The Gravity Bridge was compromised with an attack that resulted in the draining of $5.4 million.
The attacker executed a series of maneuvers involving the minting of 4 worthless tokens on the Osmosis platform, one for each custody asset: USDC, USDT, WETH, and PAXG.
These tokens were then IBC-transferred to the Gravity chain. The attacker called the permissionless deployERC20() method on Ethereum while using a fabricated cosmosDenom string that included the actual token addresses.
The validators attested to this event, allowing the registry to write fake IBC denoms that were incorrectly mapped to the real custody contracts. Consequently, the attacker was able to withdraw fake balances while the bridge released the real tokens.
On-chain evidence highlights that the denom-to-ERC20 registry was improperly written with the true custody token addresses instead of the new wrapper contracts, as confirmed by 4 MsgERC20DeployedClaim transactions on the Gravity chain. The exact code path responsible for this error is still under review in an official postmortem.
*Tweet URL:* [View Tweet](https://twitter.com/QuillAuditsAI/status/2062164090269921642)
Target: gravitybridge
*What happened:* 🚨 The Gravity Bridge was compromised with an attack that resulted in the draining of $5.4 million.
The attacker executed a series of maneuvers involving the minting of 4 worthless tokens on the Osmosis platform, one for each custody asset: USDC, USDT, WETH, and PAXG.
These tokens were then IBC-transferred to the Gravity chain. The attacker called the permissionless deployERC20() method on Ethereum while using a fabricated cosmosDenom string that included the actual token addresses.
The validators attested to this event, allowing the registry to write fake IBC denoms that were incorrectly mapped to the real custody contracts. Consequently, the attacker was able to withdraw fake balances while the bridge released the real tokens.
On-chain evidence highlights that the denom-to-ERC20 registry was improperly written with the true custody token addresses instead of the new wrapper contracts, as confirmed by 4 MsgERC20DeployedClaim transactions on the Gravity chain. The exact code path responsible for this error is still under review in an official postmortem.
*Tweet URL:* [View Tweet](https://twitter.com/QuillAuditsAI/status/2062164090269921642)
🚨 Hack Alert!
Target: ATM
What happened: 🚨 A security incident involving ATM token has been reported, where an exploit led to a loss of approximately $243,000.
The exploit is identified as a vulnerability in the transferFrom() function, which includes logic that allows the attacker to swap 20% of the transfer amount of ATM for BSC-USD. This enables the attacker to swap out extra funds repeatedly after making the transfer.
The incident highlights the need for vigilance in the crypto space.
🔗Tweet URL: View Tweet
Target: ATM
What happened: 🚨 A security incident involving ATM token has been reported, where an exploit led to a loss of approximately $243,000.
The exploit is identified as a vulnerability in the transferFrom() function, which includes logic that allows the attacker to swap 20% of the transfer amount of ATM for BSC-USD. This enables the attacker to swap out extra funds repeatedly after making the transfer.
The incident highlights the need for vigilance in the crypto space.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: GnosisPay
What happened: On 1 June, GnosisPay was exploited, resulting in a loss of approximately $265K.
The incident is reported by CertiK Alert, providing insights into the hack.
For further details, a full analysis can be accessed through the provided link.
🔗Tweet URL: View Tweet
Target: GnosisPay
What happened: On 1 June, GnosisPay was exploited, resulting in a loss of approximately $265K.
The incident is reported by CertiK Alert, providing insights into the hack.
For further details, a full analysis can be accessed through the provided link.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Infini
What happened: Infini lost $49.5M in two transactions due to a security lapse, where an admin key was never revoked. This incident highlights the vulnerability of neobanks in Web3, inheriting multiple attack surfaces from both traditional and crypto infrastructures. It underscores the importance of comprehensive audits, as a standard audit only covers the bottom layer of the neobank stack, neglecting the other ten critical attack surfaces. The tweet serves as a cautionary tale for those building card-issuing neobanks to consider all potential security weaknesses before their next audit.
🔗Tweet URL: View Tweet
Target: Infini
What happened: Infini lost $49.5M in two transactions due to a security lapse, where an admin key was never revoked. This incident highlights the vulnerability of neobanks in Web3, inheriting multiple attack surfaces from both traditional and crypto infrastructures. It underscores the importance of comprehensive audits, as a standard audit only covers the bottom layer of the neobank stack, neglecting the other ten critical attack surfaces. The tweet serves as a cautionary tale for those building card-issuing neobanks to consider all potential security weaknesses before their next audit.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: DTXT
What happened: A recent security incident was reported involving the $DTXT/USDT Pair on the Binance Smart Chain (BSC) being drained due to spoofable liquidity-addition detection logic.
The root cause of the exploit stems from how DTXT determines liquidity actions by comparing USDT balance against the pair’s reserves. The attacker exploited this by transferring a small amount of USDT to the pair, misclassifying a large DTXT sell as a liquidity addition and bypassing the associated fees.
The attack utilized a flash loan for assistance, combining liquidity addition/removal strategies with a 1 wei USDT Pair balance spoofing method.
The financial impact of the exploit was significant, with a total profit of approximately 35,041.106 USDT after the repayment of a 1,077,366.001021 USDT flash loan from Moolah.
Forensic details include the attacker’s external owned address (EOA): 0xd304ea1592f733e0a46436a01fe54bd504009526, the attack contract address: 0x3065bc8ed8bd53bdc3fd4633c3097c40726b5f5f, and helper address: 0xd2453ff82e1c5b568ddb260f1f0bb95169895428.
Further details about the DTXT token can be found at 0xac9bf7c320d4ce2d0ac978b83955dd67351897d2 and the DTXT/USDT Pair at 0x90bfc1dbc878ba54858ba8a635b3daebd2ac6c01.
The transaction associated with this incident can be reviewed here: Transaction Link.
🔗Tweet URL: View Tweet
Target: DTXT
What happened: A recent security incident was reported involving the $DTXT/USDT Pair on the Binance Smart Chain (BSC) being drained due to spoofable liquidity-addition detection logic.
The root cause of the exploit stems from how DTXT determines liquidity actions by comparing USDT balance against the pair’s reserves. The attacker exploited this by transferring a small amount of USDT to the pair, misclassifying a large DTXT sell as a liquidity addition and bypassing the associated fees.
The attack utilized a flash loan for assistance, combining liquidity addition/removal strategies with a 1 wei USDT Pair balance spoofing method.
The financial impact of the exploit was significant, with a total profit of approximately 35,041.106 USDT after the repayment of a 1,077,366.001021 USDT flash loan from Moolah.
Forensic details include the attacker’s external owned address (EOA): 0xd304ea1592f733e0a46436a01fe54bd504009526, the attack contract address: 0x3065bc8ed8bd53bdc3fd4633c3097c40726b5f5f, and helper address: 0xd2453ff82e1c5b568ddb260f1f0bb95169895428.
Further details about the DTXT token can be found at 0xac9bf7c320d4ce2d0ac978b83955dd67351897d2 and the DTXT/USDT Pair at 0x90bfc1dbc878ba54858ba8a635b3daebd2ac6c01.
The transaction associated with this incident can be reviewed here: Transaction Link.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Humanity Protocol
What happened: There has been a series of wallet compromises involving the Humanity Protocol.
Approximately $27 million in $H tokens have been transferred and dumped for around 16,320 ETH across six different addresses. The addresses involved in this transaction are as follows:
- 0x456cb73b35022e4b524e5510807776453d984aef
- 0xee4b6b8967aa947ac3aef540ee07ea6099c566f7
- 0xaf2a4989922299eb14a29e332dad1012a8aad3a0
- 0x1dfe5cf3ed5a0ac82fdd0bfcdac7b6c6323f844a
- 0xd1ea823d421e0c829ee11f772af487fd352678ea
- 0x9e995952ef7665b243eeef0693acd7fed7150504
It is essential for users to stay vigilant regarding these wallet compromises.
Tweet URL: View Tweet
Target: Humanity Protocol
What happened: There has been a series of wallet compromises involving the Humanity Protocol.
Approximately $27 million in $H tokens have been transferred and dumped for around 16,320 ETH across six different addresses. The addresses involved in this transaction are as follows:
- 0x456cb73b35022e4b524e5510807776453d984aef
- 0xee4b6b8967aa947ac3aef540ee07ea6099c566f7
- 0xaf2a4989922299eb14a29e332dad1012a8aad3a0
- 0x1dfe5cf3ed5a0ac82fdd0bfcdac7b6c6323f844a
- 0xd1ea823d421e0c829ee11f772af487fd352678ea
- 0x9e995952ef7665b243eeef0693acd7fed7150504
It is essential for users to stay vigilant regarding these wallet compromises.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: Asterix
What happened: Asterix experienced a reported attack a few hours ago, resulting in a loss of approximately $40,000.
The incident shares similarities with a previous attack on Flooring, which had a total financial impact exceeding $900,000, from which around $500,000 was rescued by white hat hackers.
Both Asterix and Flooring are based on a common design utilizing a 404-style ERC20/ERC721 hybrid contract under different names/variants.
The root cause of the vulnerabilities seems to stem from a high-bit NFT ID shift/overflow issue. This led to NFT ID reuse and severe breakdowns in ownership, approval, and accounting functions due to an underflow error.
The attack exploited the desynchronization of ownership, approvals, balances, and NFT backing. By manipulating crafted IDs with different high bits that collide with low bits, the attacker could abuse various functions such as exchange, transfer, and unwrap, thereby inflating the fungible token balance and draining liquidity pools, particularly extracting WETH and other valuable assets.
🔗Tweet URL: View Tweet
Target: Asterix
What happened: Asterix experienced a reported attack a few hours ago, resulting in a loss of approximately $40,000.
The incident shares similarities with a previous attack on Flooring, which had a total financial impact exceeding $900,000, from which around $500,000 was rescued by white hat hackers.
Both Asterix and Flooring are based on a common design utilizing a 404-style ERC20/ERC721 hybrid contract under different names/variants.
The root cause of the vulnerabilities seems to stem from a high-bit NFT ID shift/overflow issue. This led to NFT ID reuse and severe breakdowns in ownership, approval, and accounting functions due to an underflow error.
The attack exploited the desynchronization of ownership, approvals, balances, and NFT backing. By manipulating crafted IDs with different high bits that collide with low bits, the attacker could abuse various functions such as exchange, transfer, and unwrap, thereby inflating the fungible token balance and draining liquidity pools, particularly extracting WETH and other valuable assets.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: BPool
What happened: A significant exploit has impacted the BPool contract, specifically at address 0x0fa3E014fA2E751F78e53Dca766faC2223327329.
The incident resulted in a loss of approximately 282 ETH, which is equivalent to around $471,000.
This event has raised concerns within the community regarding the security measures in place for such contracts.
🔗Tweet URL: View Tweet
Target: BPool
What happened: A significant exploit has impacted the BPool contract, specifically at address 0x0fa3E014fA2E751F78e53Dca766faC2223327329.
The incident resulted in a loss of approximately 282 ETH, which is equivalent to around $471,000.
This event has raised concerns within the community regarding the security measures in place for such contracts.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: TOP
What happened: The alert describes a specific security incident involving the token $TOP.
Approximately $1.59 million was lost as a result of the attack. The attacker exploited the token's low market value to acquire over 50% of the voting power. This allowed them to pass and execute a governance proposal that resulted in minting a large quantity of TOP to themselves.
The newly minted TOP was swapped for WETH through the Balancer pool, effectively draining the existing liquidity from the liquidity pool (LP).
An attack transaction has been provided for reference: https://t.co/itXv0NCwGO.
🔗Tweet URL: View Tweet
Target: TOP
What happened: The alert describes a specific security incident involving the token $TOP.
Approximately $1.59 million was lost as a result of the attack. The attacker exploited the token's low market value to acquire over 50% of the voting power. This allowed them to pass and execute a governance proposal that resulted in minting a large quantity of TOP to themselves.
The newly minted TOP was swapped for WETH through the Balancer pool, effectively draining the existing liquidity from the liquidity pool (LP).
An attack transaction has been provided for reference: https://t.co/itXv0NCwGO.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Drift
What happened: The tweet discusses an incident involving Drift where the attacker utilized a nine-day strategy to exploit the system.
The attacker created four durable nonce accounts and conducted a council migration with four new signers.
Additionally, there was a timelock set to zero, and all of these actions were visible on-chain prior to the fund drain.
For further details, a full timeline of events is available through the provided links.
🔗Tweet URL: View Tweet
Target: Drift
What happened: The tweet discusses an incident involving Drift where the attacker utilized a nine-day strategy to exploit the system.
The attacker created four durable nonce accounts and conducted a council migration with four new signers.
Additionally, there was a timelock set to zero, and all of these actions were visible on-chain prior to the fund drain.
For further details, a full timeline of events is available through the provided links.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: MILCplatform
What happened: 🚨 A significant security incident has been reported involving the @MILCplatform bridge on both BNB and Ethereum networks.
Blockaid's Exploit Detection system has identified a compromise where the historical bridge admin wallet was exploited.
This incident allowed the new exploiter EOA to withdraw MLT (MediLoc Token) from bridge contracts. Furthermore, the attacker has gained admin control, facilitating the transfer of assets to their wallets.
Details about the attack method and the compromised roles indicate serious implications for the affected bridge contracts.
🔗Tweet URL: View Tweet
Target: MILCplatform
What happened: 🚨 A significant security incident has been reported involving the @MILCplatform bridge on both BNB and Ethereum networks.
Blockaid's Exploit Detection system has identified a compromise where the historical bridge admin wallet was exploited.
This incident allowed the new exploiter EOA to withdraw MLT (MediLoc Token) from bridge contracts. Furthermore, the attacker has gained admin control, facilitating the transfer of assets to their wallets.
Details about the attack method and the compromised roles indicate serious implications for the affected bridge contracts.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Raydium
What happened: A security incident was reported involving the project @Raydium, where the platform was drained of $1.3 million worth of crypto.
The attacker's initial funding came from the exchange #KuCoin. After the theft was executed, the stolen funds were bridged from #Solana to Ethereum (ETH).
Additionally, the attacker deposited 810 $ETH into #TornadoCash and 7 ETH into #FixedFloat.
This incident highlights significant vulnerabilities in the protocol.
🔗Tweet URL: View Tweet
Target: Raydium
What happened: A security incident was reported involving the project @Raydium, where the platform was drained of $1.3 million worth of crypto.
The attacker's initial funding came from the exchange #KuCoin. After the theft was executed, the stolen funds were bridged from #Solana to Ethereum (ETH).
Additionally, the attacker deposited 810 $ETH into #TornadoCash and 7 ETH into #FixedFloat.
This incident highlights significant vulnerabilities in the protocol.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: Humanityprot
What happened: On June 9, the identity protocol Humanity experienced a significant exploit leading to the loss of approximately $36 million. The incident occurred after an employee's laptop was compromised, which exposed multisig keys to the attackers. This breach allowed them to gain administrative control over the bridge across Ethereum and BNB Chain.
Following the exploit, the attackers upgraded the contracts, drained around 141 million $H, and minted an additional 200 million $H directly to their own wallet. This malicious activity resulted in a drastic crash of the $H token, which fell by over 80%.
The incident is described as an operational security failure rather than a smart contract bug, emphasizing the importance of securing endpoints against key compromises. Cyvers has reported that monitoring on-chain behavior in real time is critical to defending against such breaches.
🔗Tweet URL: View Tweet
Target: Humanityprot
What happened: On June 9, the identity protocol Humanity experienced a significant exploit leading to the loss of approximately $36 million. The incident occurred after an employee's laptop was compromised, which exposed multisig keys to the attackers. This breach allowed them to gain administrative control over the bridge across Ethereum and BNB Chain.
Following the exploit, the attackers upgraded the contracts, drained around 141 million $H, and minted an additional 200 million $H directly to their own wallet. This malicious activity resulted in a drastic crash of the $H token, which fell by over 80%.
The incident is described as an operational security failure rather than a smart contract bug, emphasizing the importance of securing endpoints against key compromises. Cyvers has reported that monitoring on-chain behavior in real time is critical to defending against such breaches.
🔗Tweet URL: View Tweet
🚨 Hack Alert!
Target: aztecnetwork
What happened: A suspicious transaction has been detected involving the Router contract of Aztec Network.
The exploit resulted in a loss of approximately $2.19 million. The attacker's address is reported as 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 on the Ethereum blockchain.
This incident highlights the ongoing vulnerabilities within DeFi contracts and the need for further security measures.
Tweet URL: View Tweet
Target: aztecnetwork
What happened: A suspicious transaction has been detected involving the Router contract of Aztec Network.
The exploit resulted in a loss of approximately $2.19 million. The attacker's address is reported as 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 on the Ethereum blockchain.
This incident highlights the ongoing vulnerabilities within DeFi contracts and the need for further security measures.
Tweet URL: View Tweet
🚨 Hack Alert!
Target: Thetanuts Finance
What happened: Thetanuts Finance experienced an exploit on the Ethereum blockchain, leading to the theft of approximately $105.5K in USDC.
The attack was facilitated by a flaw in the legacy vault's redemption formula, which used
Key forensic details include:
- Attacker address: 0x30498e4466789E534c72e03B52A16c978655b41e
- Loot wallet: 0xAf3a0FdBFB0e3127247B66a042310e09C32F2299
- Vulnerable index token: 0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7
- Attack transaction details: Link to transaction
Tweet URL: View Tweet
Target: Thetanuts Finance
What happened: Thetanuts Finance experienced an exploit on the Ethereum blockchain, leading to the theft of approximately $105.5K in USDC.
The attack was facilitated by a flaw in the legacy vault's redemption formula, which used
backing * amount / totalSupply to determine share payouts. The attacker manipulated the index token supply, resulting in inflated redemptions. This enabled multiple cycles of minting and claiming assets beyond the original deposits.Key forensic details include:
- Attacker address: 0x30498e4466789E534c72e03B52A16c978655b41e
- Loot wallet: 0xAf3a0FdBFB0e3127247B66a042310e09C32F2299
- Vulnerable index token: 0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7
- Attack transaction details: Link to transaction
Tweet URL: View Tweet