Digital Asset
Intelligence
Security Incident · Polygon Ecosystem

DoinGud Smart Contract Vulnerability: $35.49K Reported Loss

·Historical incident record

Incident Overview

The dormant NFT platform DoinGud was exploited on Polygon via a bug in its Diamond bidding contract: acceptBid paid out but never cleared the bid record, so the same bid could be reused. An attacker flash-loaned USDC equal to the contract balance, bid on themselves, accepted the bid twice, and drained about $35,486 USDC.e on September 21, 2026.

Sources & References

Original incident referencehttps://x.com/teddyctf/status/2102235278970933264 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 14,000
  2. Incident date
    Target

    Allbridge

    Attack methodBridge Logic Flaw
    Reported loss$ 190,000
  3. Incident date
    Target

    Royal.io

    Attack methodSmart Contract Vulnerability
    Reported loss$ 263,000
  4. Incident date
    Target

    Drop

    Attack methodGovernance Attack
    Reported loss$ 4,400,000
  5. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 23,000