What happened
On April 12, 2026, five transactions exploited SubQuery Network's Settings contract on Base and drained 382,433,441 SQT, valued at approximately $134,000 at the time. The incident affected pooled staking balances, 272 staker and delegator wallets, deployment boosters, and a small treasury balance.
Technical root cause
The Settings contract's setContractAddress function lacked an onlyOwner modifier, so any caller could update addresses for critical protocol roles including StakingManager and RewardsDistributor.
How it happened
- The attacker used permissionless Settings functions to change the registered StakingManager and RewardsDistributor addresses to attacker-controlled helpers, then used the poisoned dependencies to withdraw pooled and individual staked SQT.
- The team restored the original addresses and deployed a fix.
Protocol details
Classification
Protocol Logic / Access Control
Protocol Type
DeFi Protocol
Implementation language
Solidity
Protocol links
Website
@subquerynetwork
Evidence
Proof of concept
1 availableSources
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
