FutureSwap Hack
Reported loss
$395K
Suspected Stable-Balance Accounting
What happened
On January 10, 2026, BlockSec Phalcon reported a suspected exploit draining approximately $395,000 USDC from FutureSwap contracts on Arbitrum. The closed-source contract and inactive project team left the final root cause unconfirmed.
How it happened
The attacker used a flash loan and repeated changePosition operations to extract USDC. BlockSec's on-chain analysis associated the outflow with unexpected stableBalance changes during earlier position updates, which may have released collateral when positions were reduced or closed.
Protocol details
Classification
Protocol Logic
Protocol Type
Derivatives
Implementation language
Solidity
Protocol links
@futureswapx
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
