Leaderboard
893All-time rank
Lumi Finance
Jul 13, 2026
$270K
Lost
$270K
Recovered
$0
Net loss
$270K
Unrecovered0% recovered
On July 13, 2026, Lumi Finance on Arbitrum lost ~$270K through Sodium smart account ERC-1271 validation flaws. The exploit required two bugs: (1) Sodium accepted attacker-controlled contracts as valid signers and session keys, and (2) validateUserOp granted unlimited ERC-20 allowances via attacker-controlled paymasterAndData.
Attackers systematically stripped tokens from user accounts, leaving persistent allowances.
- Target
- DeFi
- Classification
- Input Validation
- Technique
- Signature Verification Flaw
- Attribution
- Unknown
- Chains
Arbitrum
Event timeline
- Jul 13, 2026Exploit executed — $270K drained via signature verification flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%