Incident Overview
On April 25, 2026, Purrlend lost $1.52M across HyperEVM and MegaETH when attackers compromised the team's 2/3 admin multisig wallet. They granted themselves elevated privileges including BRIDGE_ROLE, minted approximately 7M unbacked pTokens, then borrowed real assets against this worthless collateral before bridging funds out via Mayan and LiFi.
The attackers compromised Purrlend's 2/3 admin multisig wallet and used it to grant themselves full administrative privileges through the ACLManager. They assigned their own address five critical roles including BRIDGE_ROLE, POOL_ADMIN_ROLE, and EMERGENCY_ADMIN_ROLE.
With BRIDGE_ROLE access, they called the mintUnbacked function to create tokens without any collateral backing. They minted roughly 2 million pUSDm and 4.85 million pUSDC. The protocol (forked from Aave-style logic) treated these pTokens as valid collateral without checking for actual backing. The attackers then supplied these worthless tokens and borrowed real assets from the pools. They drained about $1.2M from HyperEVM and $325K from MegaETH in various tokens including USDC, USDT, ETH, and BTC.
After draining the pools, they converted most assets to USDC and ETH, then bridged portions out using Mayan and LiFi services. About 652 ETH equivalent remains traceable at a known address. The team detected the attack quickly, paused the protocol, and revoked all compromised privileges.
Blockchain Data Reference
Compromised Multisig: 0x4c2444d8…BfA1bc (2/3 threshold)
Attacker EOA: 0xd8010aca…f94C24
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Purrlend, these are the critical security checks that could have prevented this incident (April 2026).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Purrlend
The Purrlend hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.