Hackers hit deprecated Thetanuts vault for $2.1M
According to Thetanuts, the compromised contract had been deprecated years ago.
Blockchain security firm PeckShield, which flagged the incident before Thetanuts confirmed the exploit, reported that it seemed $2 million in option tokens appeared to have been recovered through whitehat efforts.
The remaining funds, about $105,000 in USDC, were swapped by the exploiter for approximately 60 ETH, according to PeckShield’s on-chain analysis. The attacker also holds $34,000 in USDC-denominated option tokens.
What led to the exploit of Thetanuts Finance legacy vault?
A vulnerability in the vault’s redemption logic is the root of the exploit, according to security researcher ExVul, who published a breakdown on X.
Thetanuts Finance responded within hours, writing on X, “Our preliminary investigation indicates that this is once again, a deprecated vault that we have migrated from years ago.”
The protocol stated, “It has no relation to any of our current contracts or products,” while adding that it would publish a full post-mortem once it gathers more details.
Blockaid’s exploit detection system also picked up the attack independently, issuing a community flagging active exploitation of the Thetanuts contract on Ethereum. The security platform also shared the exploiter’s address and the exploited contract’s address as well.
Are deprecated protocols under attack?
The Thetanuts incident adds to a growing list of deprecated protocols that have been attacked recently.
The most recent, apart from Thetanuts, is Aztec Connect, a privacy bridge abandoned since 2023, which lost $2.1 million through a separate verification flaw in its immutable smart contracts, as Cryptopolitan reported. In that case, the team had renounced all admin keys, leaving no one able to patch or pause the code.
So far in the month of June, the total value hacked in terms of DeFi exploits has crossed $46 million, and it is only midway into the month. At this pace, it may rival or exceed May, which saw its own fair share of protocol breaches.
Thetanuts has tried to assure its users of its current contracts that they are not at risk; however, the latest events have made it clear to users that abandoned code is not safe code, and so are the funds tied to them.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
USD/JPY Price Forecast: Enters fresh upside leg on consolidation breakout
CoreWeave's quarterly report hits record highs, but Bernstein and HSBC still maintain "sell" ratings
The main concerns focus on three major issues: management claims an annual price of $20-25 million per megawatt, while actual financial data shows only $9.2 million; independent calculations by two institutions both indicate a financing gap of about $33 billion; by 2028, the market will see an influx of 55 gigawatts of new computing power, 20 times CoreWeave’s own capacity. With current debt at $46.9 billion and equity only $4 billion, and no free cash flow within this decade—the question of whether its scarce performance can last until the loans are repaid is something even strong quarterly reports cannot answer.
The AI boom may follow the path of the 19th-century railway bubble, and builders may not be the ultimate winners
Goldman Sachs analyst Bobby Molavi compared the current situation to the 19th-century British railway mania: 500 companies spent more than the nation's annual income building 8,000 miles of railway, with most early investors losing out, while the real beneficiaries were the later "passengers." He pointed out that the current AI craze is driven by both debt and momentum, and that the S&P 500’s forward P/E ratio of 18x is only "a bit cheaper." Whether the builders can retain value is uncertain, and history does not offer an optimistic answer.
If Anthropic's IPO goes smoothly and the stock price rises next week, then everything remains the same for AI. Otherwise, some companies will go bankrupt.
The shrinking valuations of two major giants have triggered a chain reaction—investors are adopting more conservative revenue multiples for AI startups and are directly halting high-valuation financing for companies with zero revenue. Multiple venture capital firms have advised their portfolio companies to lower valuation expectations and to quickly build up cash reserves. Market participants warn that the outcome of Anthropic’s IPO will be a barometer for the industry: if successful, the boom will continue; if it fails, some companies may face elimination.
Crypto prices
More
