MureDistribution exploit analysis
MureDistribution's `claim()` aggregated rewards against an inflated stake weight without debiting the recorded stake, so a single block claimed the whole accrued reward. DeFiHackLabs reconstructs about 5.45 ETH drained.
- Reported loss
- ~5.45 ETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-21: Signature Verification Bypass on MureDistribution”.
Analysis1 min read
MureDistribution's claim() aggregated multiple rewards against an inflated stake weight and credited the user's claim balance without debiting the recorded balance. The attacker minted and staked just enough to inflate the stake weight in a single block, then claimed the aggregated reward.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0xb83040361a0ec72fa2d06ad69493226518a5f8b5d96c19b400626248f9c5b798 on Etherscan for a total loss of about 5.45 ETH. Defimon Alerts reported the incident.
What would have prevented it: a claim() debit on the user's recorded stake equal to the claim amount, with the aggregation reading from the same recorded stake rather than the live state.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260521-muredistribution---claim-credits-without-debiting-recorded-stake
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/MureDistribution_exp.sol
- https://etherscan.io/tx/0xb83040361a0ec72fa2d06ad69493226518a5f8b5d96c19b400626248f9c5b798
Other exploits
- SquidRouterModule exploit analysis 25 May 2026
- WUSD.fi exploit analysis 25 May 2026
- FractalProtocol exploit analysis 22 May 2026
- MAPProtocol exploit analysis 20 May 2026
- ElevateFi exploit analysis 19 May 2026
- TesseraSwap exploit analysis 18 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
