Digital Asset
Intelligence
Security Incident · Base Ecosystem

SubQuery Network Smart Contract Vulnerability: $134.00K Reported Loss

·Historical incident record

Incident Overview

Attackers exploited a vulnerability in SubQuery Network’s Settings contract on the Base network (the setContractAddress() function missing the onlyOwner access control modifier). By repeatedly calling this function, the attacker set their address as StakingManager and RewardsDistributor, enabling drainage of pooled SQT from the Staking contract, impacting 272 individual staker/delegator wallets, RewardsBooster, and a small protocol Treasury. Approximately 382,433,441 SQT were drained (worth about $134,000 USD at the time). The team quickly responded by deploying a fix, pausing withdrawals, and committing to full compensation for all affected users. No user private keys were compromised. The root cause was a missing access control from a prior code refactor.

Sources & References

Original incident referencehttps://subquery.network/blog/subquery-network-security-incident-report (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Bankr

    Attack methodSocial Engineering
    Reported loss$ 440,000
  2. Incident date
    Target

    Impermax

    Attack methodFlash Loan Attack
    Reported loss$ 400,000
  3. Incident date
    Target

    Brett

    Attack methodAccount Compromise
    Reported lossNot disclosed
  4. Incident date
    Target

    MONA

    Attack methodReserve Manipulation Attack
    Reported loss$ 60,950
  5. Incident date
    Target

    Zerion

    Attack methodAI-enabled Social Engineering Attack
    Reported loss$ 100,000