What happened
On May 25, 2026, attackers abused WUSD's GLOVE wrap-reward path on Ethereum to farm transferable rewards through fresh helper identities and sell them into GLO liquidity. The exploit reproduction describes a roughly 200,000 dollar-class incident using a Morpho USDT flash loan and repeated reward-vesting cycles.
How it happened
- The attacker used flash-loaned USDT to fund fresh helper identities.
- Each helper qualified for GLOVE rewards through the wrap path while below the reward-balance cap.
- Wrap and unwrap cycles advanced vesting and converted the rewards into transferable GLOVE.
- The helpers sold GLOVE into liquidity pools before the flash loan was repaid.
Protocol details
Classification
Other / Protocol Logic
Protocol Type
Exploit/Flash Loan Attack
Implementation language
Solidity
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert x.com
- report @exvulsec incident report x.com
- report @PeckShieldAlert incident report x.com
- code WUSD_exp.sol github.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
