Lien Finance hack drains about 542,144.63 USDC through smart-contract flaw

Lien Finance lost about 542,144.63 USDC after attackers exploited a flaw in the protocol’s bond exchange logic and then converted unsupported bond tokens into real liquidity through its GeneralizedDotc OTC pools. SlowMist said the exchangeEquivalentBonds function in the BondMakerCollateralizedEth contract failed to enforce proper bond-group integrity checks, allowing the attacker to reuse the same exception bond ID, omit another required bond from the input set, and mint assets without consuming matching collateral. The firm identified the attacker wallet as 0x0d7d…1808a, the victim address as 0xa961684a3a654fb2cca8f8991226c0cefc514d80, and estimated the loss at roughly 542,144.63 USDC. Separate analysis from DefimonAlerts, later amplified by exvulsec, described the incident as a broader protocol logic failure that also involved permissionless bond registration and weak internal pricing in Lien Finance’s bond-to-ERC20 OTC pools. Researchers said the attacker deployed an orchestration contract, registered a malicious bond group through BondMakerCollateralizedEth, and routed the resulting bond tokens into GeneralizedDotc pools, where the _calcRateBondToErc20 function appears to have assigned excessive value to assets lacking genuine backing. The attack has been characterized as a pricing and validation failure rather than a conventional reentrancy or access-control exploit. The incident adds to a string of DeFi breaches in July, including attacks on AFX Trade, the Verus Ethereum Bridge, B² Network, Lazy Summer Protocol, Bonzo Finance, Allbridge Core and Cascade. Researchers tracking the sector have estimated cumulative DeFi losses above $630 million in the first seven months of 2026. The episode also revives concerns around Lien Finance’s BondMaker design after a 2020 white-hat rescue involving a separate equivalence flaw in the original system.