New Market Trading exploit analysis
New Market Trading had an unprotected perimeter function that let any caller reset user balances. DeFiHackLabs reconstructs about $3.98M drained across 88 Gnosis Safes on Ethereum, Base, and Arbitrum.
- Reported loss
- ~$3.98M USD, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-25: Squidroutermodule Missing Caller Check on New Market Trading”.
Analysis1 min read
New Market Trading's per-user accounting exposed a balance index that could be re-set by a perimeter function gated only by a missing access control. The attacker reset users' balances to inflated values and then called withdraw() against them.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; total loss is approximately $3.98M across 88 Gnosis Safes on Ethereum, Base, and Arbitrum. The drain is in 0xa26dfe8f... on BscScan (linked references in the README).
What would have prevented it: an onlyOwner modifier on the balance-reset path, or any perimeter function with access control.
Other exploits
- LegendaryMoneyMonNft exploit analysis 28 May 2026
- Joe Agent exploit analysis 27 May 2026
- SKP Token exploit analysis 26 May 2026
- SquidRouterModule exploit analysis 25 May 2026
- WUSD.fi exploit analysis 25 May 2026
- FractalProtocol exploit analysis 22 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
