What happened
On May 27, 2025, Usual's USD0++ Investment Vault was exploited through an arbitrage opportunity, leading to a $43,000 loss from the vault itself. The main protocol remained unaffected, with no user funds lost and no pause on the Usual Core Protocol.
The exploit stemmed from a capped mechanism used to unwrap USD0++ into USD0 during deposits into the investment vault. The attacker manipulated this limitation to arbitrage the conversion process, extracting $43,000 from the vault. Since only the vault’s internal funds were impacted and user balances remained untouched, the protocol confirmed that the exploit did not compromise user safety. The affected vault has been isolated and will be reenabled after mitigation steps are implemented.
Tx:
Protocol details
Evidence
Proof of concept
1 available- Code UsualMoney Arbitrage
Sources
- report Twitter/X Alert x.com
- report @usualmoney incident report x.com
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
