Attack on Thetanuts: $2.1 million leaked from an abandoned vault — hacker returned almost everything
The DeFi sector has once again been shaken by an incident involving a vulnerability in outdated smart contracts. This time, the victim was the Thetanuts Finance protocol, from whose inactive vault an attacker siphoned approximately $2.1 million. However, unlike many other hacks, the ending of this story was unexpected: a white hat hacker returned nearly the entire amount.
The Essence of the Exploit: An Old Integer Division Bug
Security specialists from SlowMist were the first to raise the alarm. They determined that the cause of the incident was a classic error in the minting function of one of the old smart contracts. Due to incorrect integer division, the deposit calculation formula began returning zero. This allowed the attacker to generate tokens infinitely and for free, effectively draining the liquidity pool.
According to analysts at PeckShield, the hacker exchanged $105,000 in USDC for approximately 60 ETH. At the time of writing the analysis, their wallet still contains option tokens worth about $34,000, which are likely not immediately convertible.
Thetanuts Team's Response
The protocol team responded promptly to the incident, emphasizing that the hacked contract is not related to their current products. They stated that this vault was decommissioned several years ago and its vulnerability does not threaten the operational infrastructure. Notably, after a public appeal, the hacker voluntarily returned the stolen funds, indicating a "white hat" motivation — demonstrating the vulnerability rather than personal enrichment.
Expert Opinion
This case is another link in the chain of attacks on DeFi "digital ruins." Protocols often forget about old contracts that continue to hold funds but are not maintained. Thetanuts was lucky: the hacker turned out to be ethical. But in reality, such "forgotten" vaults remain ticking time bombs. Every project should conduct a full audit of all contracts ever deployed, especially those marked as inactive. Ignoring this rule will sooner or later lead to irreversible losses.