Cardex Hack

Reported loss $400K
Abstract
Private Key Compromised (Session signer)

What happened

On February 18, 2025, a compromised session signer shared by Cardex users allowed an attacker to make transactions for wallets with active Cardex sessions. Abstract's incident reporting estimated 400,000 dollars in affected funds across about 9,000 wallets; ERC-20 tokens, NFTs, Abstract Global Wallet contracts, and the core network were not affected.

How it happened

  1. Cardex users had active session authorizations that delegated limited wallet actions to the application.
  2. A session signer private key shared by Cardex users was exposed in the Cardex frontend.
  3. The attacker used that signer to transact for affected active sessions, transferring and selling shares to take ETH.
  4. Abstract advised affected users to revoke active Cardex sessions while it halted the incident path.

Protocol details

Classification Infrastructure / Input Validation
Protocol Type DeFi Protocol
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes