Gondi Hack
What happened
On March 9, 2026, Gondi's Ethereum NFT lending protocol suffered an access-control exploit in its PurchaseBundler. Public reporting estimated approximately $230,000 in NFT impact; on-chain traces document 39 successful NFT thefts and additional failed attempts.
PurchaseBundler.executeSell lacked a caller-to-loan authorization check. It accepted execution data that made the sell step succeed without an active matching loan, then used its operator approval to transfer the selected NFT from its current owner.
Case & protocol details
How it happened
The attacker used a purpose-built contract to call PurchaseBundler.executeSell with dummy loan data. Because the path did not verify that the caller was the borrower of an active loan, previously granted ERC-721 operator approvals could be used to transfer NFTs from unrelated wallets to the attacker.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- report The Block: Gondi NFT exploit report theblock.co
- transaction Etherscan: Gondi exploit transaction etherscan.io
- analysis Website reference x.com
- analysis DARKNAVY: Gondi PurchaseBundler Drain darknavy.org
- analysis GONDI security and audits docs.gondi.xyz
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
