Incident Overview
On July 16, 2026, the Solana-based lending protocol DeFiTuna suffered a smart contract exploit targeting its USDC lending pool, resulting in a loss of approximately $570,000 and leaving the lending pool at a direct deficit.
The exploit targeted a critical logic and mathematical truncation flaw in the protocol's position solvency check. In DeFiTuna's architecture, if a position's total calculated assets evaluated to zero, the contract's fallback logic automatically assumed the position was empty and perfectly healthy. The attacker exploited this by opening a spot position with zero collateral and using the integrated router to borrow $570,000 USDC from the lending pool.
They immediately swapped this USDC for a tiny fraction of TUNA tokens inside a highly illiquid, custom-seeded pool. Due to the extreme price skew, the asset value of the resulting TUNA tokens was so small that when converted to an integer via the protocol's fixed-point math routine, it truncated and rounded down to exactly zero. Because the total asset calculation returned zero, the contract skipped further health checks and deemed the position safe, allowing the attacker to cleanly walk away with the borrowed USDC.
The stolen funds were bridged from Solana to Ethereum via Mayan, where a portion was shielded through Railgun and the rest converted to DAI.
Intermediary Ethereum Wallet: 0x509b9d09…b86d3e
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to DeFiTuna, these are the critical security checks that could have prevented this incident (July 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
- 02
- 03
Learn to Prevent the Next DeFiTuna
The DeFiTuna hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.