StakeOnMe exploit analysis
StakeOnMe's stake/unstake cycle let the attacker move principal across blocks without waiting out the reward window. DeFiHackLabs reconstructs the in-block move-and-claim drain.
- Reported loss
- 0.28 ETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-03-15: Owner Privileged Jake Burn Reserve Drain on StakeOnMe”.
Analysis1 min read
StakeOnMe's stake/unstake cycle recorded the principal at stake time but paid out a reward window's share at claim time, with the share pinned to the user's recorded balance rather than the live total. The attacker unstaked in the same block as the staking to skip the reward window while moving the principal.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a reward window that requires a minimum stake duration.
Other exploits
- ATMBlindBox exploit analysis 19 Mar 2026
- Revamp exploit analysis 19 Mar 2026
- Fun.xyz CheckoutPool exploit analysis $86K
- Venus THE exploit analysis 15 Mar 2026
- AlkemiEarn exploit analysis 10 Mar 2026
- Curve LlamaLend exploit analysis 2 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
