Leaderboard
821All-time rank
Y
YieldCore-3rd-deal
Apr 28, 2026
$399K
Lost
$399K
Recovered
$0
Net loss
$399K
Unrecovered0% recovered
sender ≠ owner. Any caller could specify an arbitrary depositor as owner and direct withdrawn assets to an arbitrary receiver.
An attacker drained 392,764 USDC of principal from eight depositors across multiple calls.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Apr 28, 2026Exploit executed — $399K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%