What happened
On 31 March 2026, WhaleBit's Polygon staking system was exploited through a same-transaction spot-price manipulation. The analysis traces a net 10,506 CES retained by the exploit executor after the loan was repaid.
Technical root cause
The staking redemption path trusted a live pool spot price that an attacker could move within the same transaction.
How it happened
The attacker borrowed CES, moved the CES/USDT0 pool price during the transaction, redeemed previously minted IGT for an inflated CES payout, unwound the market leg, and repaid the borrowed CES.
Protocol details
Classification
Oracle Manipulation
Protocol Type
DeFi Protocol
Implementation language
Solidity
Attacker Address
0xe66b37de57b65691b9f4ac48de2c2b7be53c5c6f
Exploit Transaction
0x5d54fa839821e370b0…1bd725dbde
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
