Back
Thetanuts Finance suspected attack puts losses at about $2.1 million

Thetanuts Finance suspected attack puts losses at about $2.1 million

The protocol said the exploit hit a deprecated legacy vault and did not affect current contracts, while SlowMist linked the incident to an integer division truncation flaw and said most funds were recovered.

ETH
USDC

Fact Check
Multiple independent primary sources corroborate every element of the claim. PeckShieldAlert confirms the ~$2.1M loss figure. ExVul confirms the flaw was in the vault's redemption logic (backing * amount / totalSupply). Thetanuts Finance's own official X statement confirms the exploited vault was a deprecated/legacy vault unrelated to current contracts and products. These align fully with the claim's assertions about the loss amount, deprecated vault, unaffected current contracts, and redemption-logic flaw.
Summary

Thetanuts Finance said an exploit drained about $2.1 million from a legacy vault the protocol had abandoned years ago, while maintaining that the incident was unrelated to its current contracts or products. SlowMist said about $2 million of the affected position appears to have been recovered by a white-hat hacker, limiting the apparent net loss. The security firm attributed the exploit to integer division truncation in the vault’s mint function, adding a more specific technical explanation to earlier assessments that pointed to faulty vault logic. Earlier on-chain analysis from PeckShieldAlert said the remaining funds, about $105,000 in USDC, were swapped for around 60 ETH and that the attacker still held about $34,000 in USDC-denominated option tokens. Blockaid also detected the attack and issued an alert on Ethereum. The case highlights a recurring DeFi risk: deprecated smart contracts can remain exploitable long after a protocol has migrated away from them.

Terms & Concepts
  • white-hat hacker: A security researcher or ethical hacker who intervenes to protect or recover funds during an exploit.
  • integer division truncation: A coding issue in which division rounds down and discards remainders, potentially creating exploitable accounting errors in smart contracts.
  • deprecated legacy vault: An older smart-contract vault that a protocol has replaced or migrated away from but that may still remain active on-chain.