Valinity Hack

On January 3, 2026, Valinity DeFi suffered a $63,000 exploit due to a business logic flaw in its rebalancing mechanism.

The vulnerability stemmed from a business logic flaw rather than simple price manipulation in Valinity's rebalancing system. VY token functions as a synthetic asset that users can utilize as collateral to borrow BTC, ETH, and PAXG. The protocol implements an anyone-can-call function named acquireByLTVDisparity designed to rebalance VY holdings based on LTV ratios and Uniswap V3 spot prices, but this function was hardcoded to swap VY tokens into a near-empty liquidity pool containing approximately $106 USDC.

The attacker exploited this by first swapping USDC to PAXG, artificially driving the PAXG price higher rather than lower as typical price manipulation attacks would do. When the rebalance function was called with the elevated PAXG price, the contract automatically dumped VY tokens into the tiny liquidity pool at unfavorable rates. The attacker then purchased these undervalued VY tokens from the pool and used them as collateral to borrow ETH, BTC, and PAXG, successfully exiting with the stolen funds.

Following detection, Valinity immediately paused its contracts by disabling all borrow functions to prevent further exploitation.