Leaderboard
867All-time rank
M
MoonHacker
Jan 2, 2025
$300K
Lost
$300K
Recovered
$0
Net loss
$300K
Unrecovered0% recovered
MoonHacker Vault on Optimism was exploited when an attacker took a flashloan of USDC from Aave, passed a malicious contract as the mToken parameter in the executeOperation function (which lacked validation), gained unauthorized approval to transfer vault USDC, and drained the vault.
How the exploit worked
View reproducible PoCimproper input validation.
Lost: 318.9 k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Token Approval Abuse
- Attribution
- Unknown
- Chains
Optimism
Event timeline
- Jan 2, 2025Exploit executed — $300K drained via token approval abuse
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)