Highlights
- An attacker drained about $1.73 million in DAI and USDC from Notional Finance's legacy V1 escrow contract.
- The exploit abused an integer overflow: two mintfCashPair() calls created a fabricated -2^128 liability that an unsafe uint128() downcast truncated to zero.
- The stolen funds were swapped into 689.2 ETH and moved into Tornado Cash within minutes of the drain.
- The vulnerable V1 contracts had sat live and funded since Notional wound down that version after the November 2025 Balancer exploit, and nobody had swept them.
Notional Finance, a fixed-rate lending protocol, had roughly $1.7 million siphoned from a contract most of the market had stopped paying attention to. Security firm PeckShield flagged the incident after monitoring on-chain activity showing the protocol's legacy V1 escrow contract being drained of approximately $69,242 in DAI and $1.66 million in USDC. The attacker then swapped the combined haul into 689.2 ETH and routed it into Tornado Cash, the sanctioned mixing protocol, within roughly three minutes of the initial exploit transaction confirming.
The exploit's mechanics trace back to a coding flaw specific to Notional's original V1 architecture rather than any of its more recent, actively maintained versions. The attacker's address first submitted a setup transaction at 11:58:47 PM UTC on September 3, included in block 25,900,220. The actual drain transaction confirmed roughly three minutes later, at 12:01:35 AM UTC on September 4, in block 25,900,234 — a tight window that suggests the attacker had already reverse-engineered the bug and simply waited to execute once the setup was in place.
How the Overflow Bug Worked
At the center of the exploit is an integer overflow: the attacker used two mintfCashPair() calls in sequence to manufacture a liability equal to negative 2^128, an artificial debt so large and so negatively signed that it broke the contract's accounting logic. When that fabricated liability passed through an unsafe uint128() downcast inside the protocol's free-collateral valuation function, the negative value wrapped around and was truncated to zero instead of being registered as an enormous outstanding debt. In effect, the contract was tricked into believing the attacker owed nothing, freeing up collateral that should have remained locked against that liability.
Related: Term Labs Loses $8.5M as Attacker Buys Governance Vote to Drain Vaults
Why the Contracts Were Still Live
The deeper story here is about what happens to DeFi code after a protocol has moved on from it. Notional wound down its V3 architecture after the November 2025 Balancer exploit cascaded losses into its own vaults, but the original V1 contracts were never formally deprecated or swept of remaining funds — they simply sat on-chain, live and funded, no longer the focus of the team's security attention. That gap between “no longer actively used” and “no longer exploitable” is a recurring failure mode across DeFi, one that recently played out at a much larger scale when Moonwell's lending market on Base was drained of $8.7 million through an oracle exploit, and again when Cronos had to halt its entire chain after a $75 million Tectonic exploit. Once the theft is confirmed, the fallback playbook has become familiar — a Tornado Cash deposit is treated as a strong signal of intent to permanently launder rather than negotiate a return, unlike some past DeFi incidents where attackers reversed course after being publicly identified.
What Comes Next
Notional's team will need to confirm whether any other V1 contracts carry similar unswept balances vulnerable to the same downcast logic, and whether a formal post-mortem or bounty negotiation follows, as protocols increasingly do after a confirmed drain. For the wider DeFi lending sector, the incident adds to a running tally of exploits tied to older contract versions left live after a protocol's architecture has moved on, reinforcing that a full sweep-and-deprecate process, not just a migration announcement, is what actually closes the door on legacy risk.
FAQ
How much did Notional Finance lose in the exploit?
Roughly $1.7 million, made up of about $69,242 in DAI and $1.66 million in USDC drained from its legacy V1 escrow contract.
What caused the exploit?
An integer overflow bug: two mintfCashPair() calls created a fabricated massive negative liability that an unsafe uint128() downcast truncated to zero, letting the attacker bypass collateral checks.
Where did the stolen funds go?
The attacker swapped the DAI and USDC into 689.2 ETH and deposited it into Tornado Cash within minutes of the exploit.
Why were the vulnerable contracts still active?
Notional's V1 contracts were never swept of funds after the protocol moved to newer versions following the November 2025 Balancer exploit, leaving them live and exploitable.
