Hegic(old contract) Hack

Reported loss $94K
Ethereum
Unlimited repeated withdrawal exploit

What happened

On February 23, 2025, Hegic's legacy WBTC Puts Pool was exploited for approximately $80,000. Verichains describes it as an old contract that may no longer have been in production but still held funds.

How it happened

  1. The attacker repeatedly called the legacy pool's withdrawWithoutHedge function.
  2. Each withdrawal calculated its transfer from the tranche's share value.
  3. The pool did not update that share value after a withdrawal.
  4. With the tranche-state check also removed, the attacker could repeat the withdrawal until the pool was drained.

Protocol details

Classification Protocol Logic
Protocol Type DeFi Protocol
Implementation language Solidity

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes