Internet Token INT Hack

Reported loss $16K
Base
Other

What happened

On September 21, 2026, an attacker exploited Internet Token (INT) on Base. The flaw was in the LiquidityUnifier contract, which holds INT's MINTER_ROLE. A fake Uniswap V3 pool callback let the attacker mint about 925.4 million INT from nothing. The attacker sold about 161 million of them into the official INT/WETH pool for about 5.85 WETH, around $16K, and kept about 764 million INT. RektRadar reported a live loss of about $265K. That figure appears to also count the retained INT at its pre-dump price, so it is not the WETH actually drained.

swapV3(token, pool) accepted a pool address supplied by the caller. It only checked that the address held code, was not on an exclusion list, and returned INT and the passed token from token0()/token1(). It did not check a factory or registry. The swap callback's only check was that msg.sender equaled the stored current pool, which here was the attacker's fake pool. The contract's one supply guard, validateSupply, was bypassed by a round-trip through the Convertor contract.

Block data reference
  • Exploit transaction: 0xed62bb27bd1058d3d7cc93d55421d6d0001ced8cb4529b02773f5126a4edb08b
  • Victim contract (LiquidityUnifier): 0x837dbabc4f5fa78baf177597edbda09645822032
  • Attacker (existing record): 0x5f7ce6395818857ac20730dc990f614356d1ec68

How it happened

  1. The attacker deployed a fake pool contract whose token0()/token1() returned INT and a second token, then called LiquidityUnifier.swapV3() with the fake pool.
  2. swapV3 accepted the fake pool as the current pool and called its swap(). The fake pool called back into uniswapV3SwapCallback, which minted about 925.4 million INT because the callback came from the stored current pool.
  3. Still inside the fake pool's swap(), the attacker used Convertor.convert(INT, X) to burn the freshly minted INT. Total supply was back to where it started, so the validateSupply check after the swap passed.
  4. Once swapV3 returned, the attacker called Convertor.convert(X, INT) to re-mint the INT outside the guard.
  5. The attacker dumped about 161.3 million INT into the official INT/WETH Uniswap V3 pool for about 5.847 WETH and kept about 764.1 million INT.

Protocol details

Classification Token / Access Control
Protocol Type Exploit/Other
Implementation language Solidity
Protocol links Website @internet_token

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Same attack technique

Browse all hacks →
Solana Aquifer $2.5M lost Ethereum Aave $56K lost BNB Chain Chainge Finance $716K lost Ethereum BasketDAO $1.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes