Flamincome
Sep 16, 2026
balanceOf() multiplied by Curve’s spot get_virtual_price(). The attacker used approximately $18M USDT of Morpho flash liquidity to acquire USDP and imbalance-mint USDP metapool LP, then permissionlessly staked LP for the strategy through Convex.
This temporarily increased the strategy’s reported holdings/NAV. VaultYUSDT immediately incorporated the manipulated valuation into its share price, allowing the attacker to redeem shares at an inflated value and force the strategy to withdraw real aUSDT liquidity from Aave.
How the exploit worked
View reproducible PoCpermissionless Convex stakeFor inflates Strategy NAV and lets VaultYUSDT overpay on withdrawAll.
Lost: ~$345.9K USDT net attacker profit (gross Strategy loss ~$595K in aUSDT+USDT)
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Oracle Manipulation
- Technique
- Spot Price Manipulation
- Attribution
- Unknown
- Chains
Event timeline
- Sep 16, 2026Exploit executed — $595K drained via spot price manipulation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)