Leaderboard
822All-time rank
F
FutureSwap
Jan 10, 2026
$395K
Lost
$395K
Recovered
$0
Net loss
$395K
Unrecovered0% recovered
FutureSwap's changePosition collateral accounting was exploited via a large short position opened with an Aave V3 flash loan. The attacker corrupted the protocol's internal stableBalance tracking, enabling withdrawal of far more collateral than deposited, resulting in the loss of $395K in USDC.
How the exploit worked
View reproducible PoCUnit Mismatch.
Lost: 433K USD
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Withdrawal Logic Flaw
- Attribution
- Unknown
- Chains
Arbitrum
Event timeline
- Jan 10, 2026Exploit executed — $395K drained via withdrawal logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)