Leaderboard
855All-time rank
Goldfinch
Dec 2, 2025
$330K
Lost
$330K
Recovered
$0
Net loss
$330K
Unrecovered0% recovered
A flaw in Goldfinch's legacy collectInterestRepayment() function permitted transfers from any approved address without proper safeguards. An attacker deposited USDC to manipulate share price, then repeatedly withdrew inflated amounts, draining the victim's holdings through the contract's misconfigured approval logic.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Token Approval Abuse
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Dec 2, 2025Exploit executed — $330K drained via token approval abuse
- Attributed to Unknown
- Recovery status Unrecovered 0%