Attackers drained roughly $2.1 million from a deprecated Thetanuts Finance vault in the latest Decentralized Finance (DeFi) exploit. Whitehat defenders recovered about $2 million in option tokens.
The breach hit an old vault that the protocol had already migrated from years ago. Thetanuts said the vault has no connection to its active products or current systems.
Inside the Thetanuts Vault DeFi Exploit
Blockchain security firms flagged the incident on X (formerly Twitter). SlowMist traced the root cause of the integer division flaw in the contract’s mint function.
Following the vault drain, the deposit formula evaluated to 0 due to rounding during integer division, allowing an attacker to mint tokens for free. The flaw ultimately enabled unlimited token creation.
PeckShield revealed that the exploiter swapped $105,000 in USDC (USDC) for around 60 Ethereum (ETH). The wallet still holds roughly $34,000 in option tokens.
Follow us on X to get the latest news as it happens
Thetanuts also addressed the exploit in a public statement.
“Our preliminary investigation indicates that this is once again, a deprecated vault that we have migrated from years ago. It has no relation to any of our current contracts or products. We will release a post-mortem once we get more details,” the team said.
The attack fits a pattern of exploits striking dormant or legacy code. Old contracts often stay live on-chain even after teams stop maintaining them.
BeInCrypto reported that attackers drained about $2.1 million from Aztec Connect, which was deprecated three years ago. A separate breach hit Raydium (RAY) legacy liquidity pools for roughly $1.3 million.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
