Thetanuts Hack: Outdated Vault Costs Protocol $2.1 Million
Once again, the DeFi sector has faced an incident that serves as a reminder of "toxic assets" in the blockchain. This time, the target of the attack was the decentralized options protocol Thetanuts Finance. The attackers withdrew approximately $2.1 million from a vault that the project team had not used for a long time. However, as often happens, white hat hackers intervened promptly and returned about $2 million.
Attack Details: A "Dormant" Contract and a Division Error
The exploit affected a smart contract that Thetanuts stopped supporting several years ago. In an official statement, the team emphasized that this contract is in no way connected to current products or the working infrastructure. Nevertheless, it remained active on the network, which became the entry point for the attacker.
Security specialists identified that the root of the problem was an error in the integer division function within the internal logic of token minting. Due to rounding peculiarities when calculating the deposit, the formula began returning zero. This allowed the hacker to mint option tokens in unlimited quantities without depositing real collateral. In effect, the attacker created tokens out of thin air and then exchanged them for liquid assets.
According to analysts, the hacker has already converted $105,000 into USDC for approximately 60 ETH. The attacker's wallet still holds option tokens worth about $34,000, which have not yet been cashed out.
The Trend of "Zombie Contracts"
The Thetanuts incident is part of a worrying trend. We are seeing a series of attacks on forgotten or outdated smart contracts that continue to operate even after official support has ceased. Previously, similar hacks occurred on Aztec Connect (loss of $2.1 million) and Raydium (loss of $1.3 million from outdated liquidity pools). This proves that leaving a contract to "rot" on the network means leaving the door open for attackers.
Expert Opinion: This case is a harsh reminder for all DeFi teams. It is not enough to simply "disable" support for an old contract. If it remains on the blockchain, it still poses a threat. The "decommissioning" procedure must include complete blocking or destruction of the contract. Otherwise, old code can become a "time bomb" for the entire ecosystem.