MTToken exploit analysis
MTToken's transfer fee was computed against the receiver's pre-funded `balanceOf`, so the attacker pre-funded a receiver, transferred MT in, and walked the inflated fee-balance out via a refund. DeFiHackLabs reconstructs about $37K drained.
- Reported loss
- 37K USD, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-01-12: Incorrect Fee Logic on MTToken”.
Analysis1 min read
MTToken's transfer fee was computed against the contract's balanceOf for the receiver, which the attacker had pre-funded. The attacker staged a pre-funded receiver, transferred MT in, and the contract charged a fee against the inflated balanceOf, walking the fee-balance out via a refund path.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; [the drain is in the README's tx reference]. Total loss is approximately $37K USD.
What would have prevented it: a transfer fee computed against the receiver's recorded balance at transfer time, not the balanceOf snapshot the attacker can pre-fund.
Other exploits
- Moonwell February 2026 exploit analysis 15 Feb 2026
- Makina exploit analysis 20 Jan 2026
- SynapLogic exploit analysis 20 Jan 2026
- FutureSwap exploit analysis 10 Jan 2026
- Truebit exploit analysis 9 Jan 2026
- PRXVT exploit analysis 1 Jan 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
