WHALE exploit analysis
WHALE staged LP credit and hashrate reward settlement under a Moolah USDT flash plus a Pancake Vault lock, leaving the WHALE/USDT pair's recorded balance higher than its actual token balance. The attacker swapped about 3,460.41 USDT out of the pair.
- Reported loss
- 3,460.41 USDT, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-17: Transfer Accounting Reserve Desync on WHALE”.
Analysis1 min read
The WHALE/USDT Pancake pair was manipulated through a Moolah USDT flash loan and a Pancake Infinity Vault lock, while WHALE's transfer pipeline staged LP credit, flushed POL liquidity, and settled hashrate rewards. The combination left a deep reserve imbalance: the pair recorded more WHALE than its actual balance, and the attacker walked the inflated WHALE balance out against the USDT side.
The attacker at 0xa27eae743cd8c03e9b7c25ebf43dadbbc6df9bfa deployed helper 0x4ce3e5dea552d1440a8cd766a13a6384ea4d1386 with the staging logic at 0x8420c6657bf7c37c7014e158404b6416fd82f714, executed the flash-staging sequence, and swept the residual USDT.
DeFiHackLabs reports a total loss of about 3,460.41 USDT. The drain is in 0xf8f431b392a50eb997ecae2e35668d6dd4dc8568d002057600d2532e18f36d86 on BscScan.
What would have prevented it: WHALE's transfer pipeline ought not to settle LP credit and hashrate reward concurrently, or to do so under a TWAP-priced guard rather than the spot pool price.
Sources read (3)
Other exploits
- JB exploit analysis 18 Jun 2026
- Aztec V1 exploit analysis 17 Jun 2026
- LBP exploit analysis 17 Jun 2026
- DIP exploit analysis 16 Jun 2026
- Aztec Connect exploit analysis $2.1M
- Thetanuts exploit analysis 15 Jun 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
