Gondi Hack

On March 9, 2026, Gondi Protocol on Ethereum suffered a $230K exploit affecting approximately 40-78 NFTs when an attacker exploited an unguarded onERC721Received() callback in the Purchase Bundler contract, using attacker-controlled recipient and token ID data to steal NFTs from users who had approved the contract. NFTs held as collateral in active loans were not affected.

The attacker deployed a malicious contract with an unguarded onERC721Received() callback and set it as the borrower in the Purchase Bundler contract. When the Purchase Bundler called safeTransferFrom() to transfer NFTs, it triggered the attacker's callback function. Inside this callback, the attacker decoded their own supplied recipient and token ID data to redirect NFTs to their address before returning success to the Purchase Bundler. This approval vulnerability allowed the attacker to steal NFTs that were not currently locked as collateral in active loans but had been approved to the Purchase Bundler contract. The attacker began selling stolen NFTs immediately after the exploit. Gondi advised users to revoke approvals to all affected Purchase Bundler contracts and not to repay loans or initiate new platform activity until confirmed safe.

Blockchain Data Reference

Exploiter: 0x8d171c74…f47051

Exploit Contract: 0xe95e3cfc…84d73c

Exploit Transaction: 0x83bac5d4…9e6a06