Incident Overview
On March 17, 2026, dTRINITY's dLEND protocol (an Aave V3 fork) on Ethereum suffered a $257K loss in a "first deposit inflation attack" when an attacker used a massive $837M flash loan from Morpho to deposit 772 USDC and manipulate the share index, inflating collateral valuation to $4.8M and borrowing $257K dUSD. The protocol committed to 100% coverage from treasury within 24 hours.
The attacker executed a classic first deposit inflation attack against dLEND's Ethereum deployment. Using an $837M flash loan from Morpho, the attacker deposited a small amount of 772 USDC as the first depositor into a lending pool. By manipulating the share price calculation through direct token transfers or donations, the attacker artificially inflated the exchange rate/index, causing the initial 772 USDC deposit to be valued at approximately $4.8M in collateral.
With this massively inflated collateral value, the attacker borrowed $257K dUSD against what should have been worth less than $800. The attacker then repaid the Morpho flash loan and withdrew approximately $250K dUSD profit. The attack exploited a known vulnerability in Aave V3 forks where the first depositor can manipulate share prices before sufficient liquidity exists to stabilize the exchange rate.
Exploiter Address: 0x5cc74193…30fd60
Flash Loan Source: Morpho (0xBBBBBbbB…EEFFCb)
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to dTRINITY, these are the critical security checks that could have prevented this incident (March 2026).
- Verify all logic paths related to Flash Loan Attack / Deposit Inflation Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next dTRINITY
The dTRINITY hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.