MALT loses about $72,000 after swap flaw exposes treasury DAI

Oct 3, 2026 18:07 (20d ago)

An attacker exploited MALT’s swap function and drained funds from the protocol.
About $72,000 was lost after the attacker used a small input.
SlowMist reported the incident on October 3, 2026, identifying treasury-supplied DAI involvement.

A DeFi attacker drained about $72,000 from MALT by exploiting a flaw in its swap(uint256,uint256,address) function, SlowMist reported on October 3, 2026. The function recorded the caller’s input and pre-swap reserves, then called an external rebalanceHook before transferring the requested output. The hook withdrew DAI from MALT’s Capital Source, allowing the attacker to extract treasury funds and receive more MALT than the transaction should have allowed.

DAI