What happened
A QNT liquidity pool on Ethereum was drained on 28 April 2026 after a delegated administrator account was used to execute a public routing path.
Technical root cause
A delegated administrator EOA could be used through a public batch-routing path without an access-control boundary that prevented the pool drain.
How it happened
The documented transaction routed a delegated administrator account through a public batch path and removed 1,974.5 QNT from the pool.
Protocol details
Classification
Access Control
Protocol Type
Token
Implementation language
Solidity
Protocol links
Website
@quant_network
Attacker Address
0x6ee4df5a0272fd05fa1c2d4e4fa176edff12d430
Exploit Transaction
0xef9994ac862318ccf3…8d7b98684f
Evidence
- transaction QNT exploit transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis QNT pool drain on-chain analysis darknavy.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
