Aquifer Hack

Reported loss $2.5M
Solana
Other

What happened

On August 31, 2026, Aquifer's Solana AMM was exploited in approximately 212 swaps for an estimated $2.47 million across USDC, USDT, HYPE, cbBTC, CASH, and other tokens. BlockSec reported that the swap path allowed callers to choose the Token Program for each settlement transfer without validating the choice.

How it happened

  1. Each Aquifer swap settled one incoming and one outgoing token transfer.
  2. The caller could provide the program used for either transfer.
  3. The attacker supplied a malicious program for the payment-in transfer, which returned success without moving the input token.
  4. Aquifer nevertheless invoked the genuine token program for the outgoing transfer, releasing real assets over repeated swaps.

Protocol details

Classification Exchange (DEX)
Protocol Type DEX
Protocol links Website @_aquifer_

Evidence

Same attack technique

Browse all hacks →
Harmony $300K lost MoneyMon $85K lost Hyperliquid $1.5M lost Gyroscope $807K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes