Incident Overview
On January 6, 2026, IPOR's USDC Fusion Optimizer Arbitrum Vault suffered a $336,000 exploit due to a combination of missing fuse validation in a legacy vault contract and an EIP-7702 vulnerability that allowed arbitrary external calls through a compromised admin account, with approximately $267,000 laundered through Tornado Cash.
The exploit combined two vulnerabilities in a legacy vault deployed 490 days prior. The administrator account (0xd8a1...) used EIP-7702 to delegate execution to an implementation contract (0xa3cc...) containing an arbitrary external call function. The attacker leveraged this to hijack the admin's identity and call configureInstantWithdrawalFuses, which lacked fuse validation, injecting a malicious fuse into the vault.
Upon triggering instantWithdraw, the vault executed the attacker's fuse, draining $336,000 USDC. CertiK tracked $267,000 bridged to Ethereum and deposited into Tornado Cash. IPOR DAO is providing full reimbursement from treasury while Security Alliance attempts fund recovery.
Tx: https://arbiscan.io/tx/0x238b4e61…9671b6
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to IPOR Fusion, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to EIP-7702 Delegation Exploit / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$336K
Net Loss
0
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next IPOR Fusion
The IPOR Fusion hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.