The $2.1 million Thetanuts hack: an old vulnerability, fund recovery, and lessons for DeFi
The Thetanuts Finance decentralized finance (DeFi) protocol was exploited, resulting in an attacker withdrawing approximately $2.1 million from a legacy vault. However, notably, "white hat hackers" have already returned most of the funds — roughly $2 million. Let's break down the details of this incident.
How did the attack happen?
Companies specializing in blockchain project security were the first to raise the alarm. According to analysts, the cause of the hack was an integer division error in the internal minting function of the smart contract. The essence of the problem was that after funds were withdrawn, the deposit formula began returning zero due to rounding specifics in integer division. This allowed the hacker to mint tokens virtually for free and in unlimited quantities.
It is important to emphasize that the attack only affected one long-unused vault. The Thetanuts team officially stated that this contract is not connected to current products or the active infrastructure. They promised to publish a detailed report after all circumstances are clarified.
Fund movement and return
According to blockchain detectives, the hacker exchanged $105,000 in USDC for approximately 60 Ethereum (ETH). The attacker's wallet also still holds option tokens worth about $34,000. However, the key point is the return of funds. "White hat hackers," or possibly the attacker themselves, returned almost the entire stolen amount, which is a positive signal for the community.
Trend of attacks on "forgotten" contracts
The Thetanuts case is not an isolated incident. We are observing a worrying trend: hackers are increasingly targeting abandoned or outdated smart contracts. Even after support is discontinued, such contracts continue to exist on the blockchain, and their vulnerabilities can be exploited. Similar attacks were previously recorded on Aztec Connect (withdrawal of $2.1 million) and Raydium (loss of $1.3 million from old liquidity pools).
My expert opinion: This incident is a stark reminder that in DeFi, "dead" contracts do not disappear without a trace. Project teams need to implement procedures for "destroying" or completely blocking outdated smart contracts, and users should more carefully verify which protocol versions they are interacting with. Security is an ongoing process, not a one-time action.