What happened
On June 2, 2023, Hector Network's new bridge was exploited for approximately 652,600 USDC from its treasury. CertiK describes an attacker-created fake USDC token and malicious calldata that transferred real USDC. Although the historical URL calls this Hector Lending, the cited incident concerns the bridge, not a demonstrated lending-market exploit.
The bridge interaction accepted malicious token and call inputs that could be used to transfer real treasury USDC. The cited account does not provide enough detail to name the exact vulnerable function confidently.
How it happened
The attacker introduced a fake USDC token into the bridge flow and supplied calldata that caused real USDC to leave the victim treasury. CertiK discusses this case as an example of unsafe calldata handling in integrations with token-spending permissions.
The verified scope here is the June 2023 bridge incident. It should not be merged with later Hector treasury events. The source supports the approximate transferred amount and broad mechanism, but not a complete transaction-by-transaction reconstruction or a confirmed recovery figure.
For reviewers, a token address supplied by a caller must not be allowed to redefine the authority or destination of a treasury transfer.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
