The $2.1 million Thetanuts hack: a forgotten contract that should not have been left unattended
The DeFi sector has been shaken again by news of a hack, but this time the incident is more managerial than technical in nature. The Thetanuts Finance protocol lost approximately $2.1 million due to the exploitation of an outdated vault that the team had long abandoned. Notably, almost the entire amount — around $2 million — was returned by white hat hackers, raising questions about security procedures in projects with "dead code."
The attack targeted a smart contract that the protocol stopped using several years ago. Thetanuts emphasized that this contract is unrelated to current products and active infrastructure. However, as practice shows, "forgotten" contracts continue to exist on the blockchain, and their vulnerabilities are a goldmine for attackers.
How It Happened
Security specialists from SlowMist were the first to raise the alarm. They determined that the root cause was an integer division error in the smart contract's internal minting function. After funds were withdrawn, the formula for calculating deposits began returning zero due to rounding specifics. This allowed the hacker to mint tokens literally out of thin air, in unlimited quantities.
According to PeckShield, the attacker exchanged $105,000 in USDC for approximately 60 ETH. The attacker's wallet still holds option tokens worth about $34,000. The Thetanuts team has promised to publish a detailed report after the investigation concludes.
This case is not isolated. Previously, we observed similar attacks on Aztec Connect ($2.1 million) and outdated Raydium liquidity pools ($1.3 million). The overall trend is clear: attackers are deliberately hunting for "dormant" contracts that continue to operate without support.
My professional opinion: The Thetanuts incident is yet another reminder that in DeFi, you cannot simply "forget" a contract. Any code once deployed on the blockchain remains there forever. Teams need to implement automated monitoring systems and procedures for the forced deactivation of outdated contracts. Otherwise, such "surprises" will become the norm.