A vulnerability in Superfluid’s Celo deployment allowed an attacker to create excess G$ and exchange it for assets from GoodDollar reserves and external liquidity pools. GoodDollar said 86,588 cUSD left its Celo reserve and another $20,857 was exchanged from its XDC reserve, although the projects have not disclosed losses from external pools or explained the XDC outflow. Superfluid’s Security Council said a malicious Super App bypassed whitelisting and kept insolvent G$ balances active instead of liquidating them. Superfluid detected the accounts on Sept. 3, traced the failure on Sept. 4, deployed a hotfix, restored whitelisting and closed affected accounts. GoodDollar said monitoring alerts, emergency pauses and existing safeguards prevented its Celo and XDC reserves from being depleted. Claiming, transfers and identity verification have resumed on Celo, but reserve operations, bridging and some liquidity remain paused. GoodDollar advised users not to swap G$ until liquidity improves because thin markets can cause significant slippage, or execution at materially different prices. The protocol distributes G$ daily as part of a decentralized universal basic income system, with stablecoin-backed reserves and DeFi (decentralized finance) investment yield supporting issuance and distributions.