Monday, June 15, 2026

Thetanuts Finance

Funds lost

$105K

Attack type

Flash Loan Attack

Network

Ethereum

Category

Other

Summary

In 15th June 2026, the decentralized options protocol Thetanuts Finance suffered a smart contract exploit on Ethereum mainnet targeting its legacy vault contracts, resulting in a loss of approximately $105,000.

Details of the Exploit

The exploit targeted 2021-deployed legacy ETH vault contracts that contained residual balances from historical premiums and settlement flows. The attacker manipulated an inherent calculation flaw within the vault's minting and redemption math logic. By leveraging flash loans, the attacker engineered an edge-case state by forcing the vault's total token supply down to near-zero conditions.

At this micro-supply boundary, the division and truncation rounding math in the mint and claim functions broke down, creating an integer calculation flaw. This mathematical distortion allowed the attacker to mint vastly overvalued shares or redeem an outsized portion of the remaining underlying residual assets relative to their actual collateral input. While the exploiter attempted to replicate this attack sequence across other deprecated legacy vaults, those subsequent attempts yielded only obsolete, unbacked LP tokens carrying zero real market value, isolating the protocol's total financial damage to the initial $105,000 drain.

Source: De.Fi REKT Database. Data as of November 3, 2026.