Lumi Finance Hack

On July 13, 2026, the decentralized finance protocol Lumi Finance on Arbitrum suffered an exploit targeting its integrated Sodium smart accounts. The attacker bypassed user authorizations to drain approximately $264,000 (roughly 148 ETH) from multiple smart accounts.

The attack capitalized on a critical validation-time logic flaw in the user operation (UserOperation) processing pathway of the Sodium smart accounts. In ERC-4337 (Account Abstraction) architectures, the validation phase of a user operation is strictly meant to verify signatures and account balances without executing downstream state modifications.

However, the vulnerable smart accounts incorrectly allowed token approvals to be executed as a side effect directly during this initial validation phase. The attacker set up a malicious Paymaster contract (0x56362412…58e8a1) and initiated standard user operations. During the validation gate, the rogue Paymaster forced the smart accounts to authorize massive ERC-20 token allowances to the attacker's contract without the users’ explicit intent or consent. Once these allowances were secured, the attacker deployed a sweeping contract to batch-transfer the approved assets out of the compromised wallets, swapped them into ETH, and laundered the proceeds.

Attacker Address: 0xce1a3bb0…888d88

Malicious Paymaster / Contract: 0x56362412…58e8a1

Primary Attack Transactions:

0x630654fb…4c6604

0x020995ec…b0ea90