Leaderboard
1017All-time rank
Scallop Lend
Apr 26, 2026
$142K
Lost
$142K
Recovered
$0
Net loss
$142K
Unrecovered0% recovered
Attacker exploited deprecated V2 contract from November 2023; uninitialized 'last_index' variable in rewards logic allowed unbounded claims. Using flashloan and oracle manipulation, attacker drained the sSUI rewards pool.
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Reward Logic Flaw
- Attribution
- Unknown
- Chains
Sui
Event timeline
- Apr 26, 2026Exploit executed — $142K drained via reward logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%