Leaderboard
1083All-time rank
D
DRLVaultV3
Nov 10, 2025
$100K
Lost
$100K
Recovered
$0
Net loss
$100K
Unrecovered0% recovered
DRLVaultV3, a USDC-WETH rebalance vault, was exploited by an attacker who manipulated the Uniswap spot price. The attacker first borrowed 14M USDC from Morpho Blue and bought WETH to spike its price, then triggered the vault's swapToWETH function to force it to buy WETH at the inflated price, and finally sold the pre-purchased WETH back into the pool to capture the profit spread.
eth) captured the approximately $100K in USDC that should be recoverable.
How the exploit worked
View reproducible PoCPrice Manipulation.
Lost: 100k USD
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Oracle Manipulation
- Technique
- Spot Price Manipulation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Nov 10, 2025Exploit executed — $100K drained via spot price manipulation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)
