DeFi Exploits: 3 Hacks in 6 Weeks, 114 ETH to $2.7M - shattered.io

Three unrelated bugs have drained DeFi protocols since October 1, 2026, with losses ranging from roughly 114 ETH to about $2.7 million. The pattern matters more than the totals, as each incident targeted a different layer of the blockchain stack—virtual machine, application contract, and wallet module—slipping past the checks teams usually trust. Initia's trouble follows a cluster of bridge hacks involving Cysic, WAX and Initia reported in late October.

Initia's MoveVM Flaw

Initia, a Layer 1 with rollups built on the Cosmos SDK with a MoveVM execution layer, halted operations on October 23 after a vulnerability allowed an attacker to create unbacked balances for WETH, AUSD0 and USDC. The attacker exploited the flaw to mint tokens that could be redeemed through bridges against real reserves, draining approximately $2.7 million before the halt.

Initia announced a recovery plan on October 30, resuming operations on November 2 after applying an independently audited MoveVM patch. The plan isolated forged balances, restored backing for affected tokens, and maintained transaction history without rollback. Post-restart, LayerZero withdrawals faced a 24-hour delay while Noble USDC withdrawals had hourly limits to allow operators time to spot suspicious activity.

Eight days after the restart, Initia halted its L1 again on November 10 after compromised rollup infrastructure keys were used to forge IBC transfers. Reports indicate about $615,000 in USDC plus $10,000 in other tokens were stolen from a custody account, though conflicting reports suggest a higher figure near $3.27 million. The company stated no evidence of user funds being affected, but the distinction between the October code vulnerability and November key compromise is critical.

UNCX Vesting Bug

UNCX Network's Smart Token Vesting V2 contracts were exploited on October 14 due to inconsistent share accounting. When vesting positions were released, topped up and canceled in certain sequences, the contract's internal records stopped matching the token balance, allowing attackers to withdraw more than entitled. Initial estimates showed a drain of about $1.49 million across Ethereum, Base, BNB Smart Chain and Robinhood Chain.

UNCX published an official cross-chain incident report on October 15, updating it on October 17. Later reporting suggests the realized extraction was lower, around $808,000, with about $58,000 recovered by whitehats. As containment, UNCX raised the fixed fee for new locks to over 1,000 ETH, removed fee-bypass paths, and set token fees to the maximum 5%, effectively making Vesting V2 unusable for new customers.

FlashLoopAdapter Vulnerability

FlashLoopAdapter, a third-party Safe module that allows users to open and close leveraged Aave V3 positions using flash loans, was exploited on October 1. An attacker deployed a fake Safe contract that falsely confirmed it was enabled to the module, then used this to make two real Safes execute unauthorized transactions, resulting in a loss of about 114 ETH.

The flaw represents a classic confused-deputy design where the module trusted a caller-supplied response without verification. Public technical analyses recommended independently registering authorized Safes and restricting router destinations or calldata. The same module-authorization theme runs through recent smart account exploit analyses. As of November 9-11, incident trackers still list FlashLoopAdapter as hacked, with no confirmed patched redeployment.