Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Nimiq Smart Contract Vulnerability: $50.46K Reported Loss

·Historical incident record

Incident Overview

An attacker abused an OpenGSN meta-transaction auth flaw on Polygon HTLC contracts: open/execute accepted a spoofed from without a real user signature. Posing as liquidity wallet 0x24cb…6773, they used leftover near-unlimited ERC-20 allowances to lock 26,130.64171 USDC, 24,332.489269 USDT0 and 0.661117 USDC.e into HTLCs with attacker-chosen recipient and secretHash=sha256(1), then redeemed via a CREATE2 contract with secret=1. Single-tx loss was about $50,463.

Sources & References

Original incident referencehttps://x.com/DefimonAlerts/status/2100868892742602793 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Startale

    Attack methodSmart Contract Vulnerability
    Reported loss$ 2,876
  2. Incident date
    Target

    Nostra

    Attack methodOracle Manipulation
    Reported loss$ 3,500,000
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 7,730,000
  4. Incident date
    Target

    Spiral

    Attack methodPrice Manipulation
    Reported loss$ 26,800
  5. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 345,900