What happened
On September 16, 2026, an attacker exploited old, still-live Flamincome contracts on Ethereum (Flamingo Finance's yield aggregator) with an ~$18 million USDT flash loan. By inflating the tracked holdings of the VaultYUSDT Strategy, the attacker redeemed vault shares for more than they were worth. The Strategy lost 597,352 USDT gross (about $595K), and the attacker netted about 344,751 USDT (~$345.9K) after costs.
Blockaid detected the attack. The attacker's address was funded with 0.1 ETH from Tornado Cash about two hours before the exploit and later moved 144.15 ETH through LI.FI. Flamingo Finance had not publicly responded at the time of reporting.
How it happened
- The attacker took a USDT flash loan of about $18 million (from Morpho, per the DeFiHackLabs PoC) and made an ordinary deposit into
VaultYUSDTat a fair share price. - The attacker cheaply bought USDP/3CRV metapool LP tokens while USDP was deeply depegged (around $0.20). The Strategy valued these LP tokens by the pool's virtual price (~1.015), with no deviation guard.
- The attacker deposited the LP into Convex and called the permissionless
BaseRewardPool.stakeFor(Strategy, amount), crediting about 693K LP tokens to the Strategy and inflating its reported holdings and the vault share price. - The attacker called
withdrawAll()and redeemed the shares for liquid aUSDT at the inflated price, repaid the flash loan, and kept about 344,751 USDT.
Protocol details
Evidence
Proof of concept
1 availableSources
- report @coinminutes_en incident report x.com
- code Add Flamincome VaultYUSDT exploit PoC - permissionless Convex stakeFor inflates Strategy NAV, VaultYUSDT overpays on withdrawAll (DeFiHackLabs PR #1266) github.com
- analysis DeFiLlama defillama.com
- analysis Blockaid Flags FlamingoFinance Contract Exploit, $345.9K Stolen cryptotimes.io
- analysis FlamingoFinance Loses $346,000 in DeFi Exploit Using $18M Flash Loan kucoin.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
