dTRINITY Hack

On 27 September 2025, an attacker stole about $56K from dLEND, the lending market of dTRINITY, on Sonic and Fraxtal. dLEND's collateral-swap adapter, which routes swaps through Odos (OdosLiquiditySwapAdapter), let any caller name *another* user as the swap owner. The adapter then spent that user's existing approvals for dLEND receipt tokens (aTokens). The attacker exploited this with swap routes they controlled, taking the victims' collateral and leaving them only dust.

Three wallets were hit, all belonging to dTRINITY team members who had granted high or unlimited approvals while testing. dTRINITY's interface asked users to approve only the exact amount needed for each transaction, and the team said no other users' funds were affected. Its first estimate was under $100K, later revised to $56K. In response, dTRINITY paused dUSD transfers during the investigation, removed collateral swaps from the UI, told users to revoke approvals to the affected adapters, and said it would reimburse the team members. The post-mortem notes that the adapter had been part of an earlier audit by Verichains, which missed this vector.