HumaFinance exploit analysis
HumaFinance's credit-token redeem priced its payoff against an oracle that the attacker had flash-moved, so the redemption captured the inflated payoff. DeFiHackLabs reconstructs the in-pool USDT balance drained.
- Reported loss
- ~$101K (82,315 USDC + 19,074 USDC.e), per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-11: Credit Approval Bypass on HumaFinance”.
Analysis1 min read
HumaFinance's redeem of a credit-bearing token accepted an oracle-priced payoff that the attacker had previously moved via a flash loan. The attacker redeemed at the inflated payoff, leaving the pool with the credit balance and the attacker with the redeemed value.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; total loss was recorded as approximately the credit pool's full USDT balance.
What would have prevented it: a redemption priced against a multi-block oracle, or any redemption that caps per-block payouts.
Other exploits
- VerusBridge exploit analysis 17 May 2026
- AdsharesBridge exploit analysis 15 May 2026
- SQTokenStaking exploit analysis 12 May 2026
- INKFinance exploit analysis 11 May 2026
- Renegade exploit analysis 10 May 2026
- TrustedVolumes exploit analysis 7 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
