What happened
On April 18, 2025, an attacker exploited Numa Money, an LST-backed synthetics protocol on Arbitrum, through NUMA price manipulation. Hypernative put the attacker's profit at about 292.96 rETH (~$506K). SolidityScan estimated $527,328. The stolen funds were bridged from Arbitrum to Ethereum and laundered through Tornado Cash.
NUMA's vault price came from the vault's own state, and NumaVault.sell() had no real-time price check or slippage protection. The lending market also let a user borrow more NUMA than existed. Numa's team named three enabling factors: a donation that moved NUMA's price, borrowing beyond NUMA's existing supply, and NUMA being borrowable at all.
Hypernative said its platform flagged the attack more than seven minutes before it was executed.
Numa paused lending on Arbitrum and kept the vault running. It said it would deposit about 35 rETH of vault rewards, plus a $100,000 outside contribution, to bring NUMA back toward its pre-incident price. It also said it would turn off short positions on NUMA before launching on Sonic.
Exploit transaction: [0x74a19463...](Tx 0x74a1…0e3c)
How it happened
- The attacker flash-borrowed 3,760 rETH and 631,422 NUMA from Aave V3, Balancer, Uniswap V3 and other pools.
- It deposited rETH to mint crETH collateral, then borrowed 3,626,482 NUMA through
CNumaLst.borrowFreshNoTransfer(), repeating the deposit-and-borrow cycle five times. No supply cap stopped it. - It sold a large amount of NUMA into
NumaVault.sell(), which moved the vault's storedlast_lsttokenvalueWeifrom 148,850,422,003,959 to 116,943,924,501,586. It then calledlockNumaSupply(true)to hold that pricing in place. - It donated 150 rETH directly to the vault to push up NUMA's vault price, then redeemed 283 rETH through
CNumaLst.redeemFresh()at the skewed exchange rate. - It bought back 85,511 NUMA through
NumaVault.buyNoMax(), repaid the flash loans, and kept about 292.96 rETH. It bridged the proceeds to Ethereum and sent them through Tornado Cash.
Protocol details
Evidence
- transaction Arbiscan - exploit transaction 0x74a19463... arbiscan.io
- analysis Hypernative Detection: $506K Exploit of Numa Money on Arbitrum hypernative.io
- analysis NumaMoney Hack Analysis (SolidityScan) blog.solidityscan.com
- analysis DeFiLlama defillama.com
- analysis Incident Update and Moving Forward (Numa) numa.money
- analysis Numa Incident Analysis - CertiK (August 2025 Sonic incident, for comparison) certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
