Incident case file

MUSystem — First-deposit bonus double-count drains ETH pool

Incident date Sep 15, 2026Last updated Oct 8, 2026

1 views

ClosedEthereum L1Business-logic flaw (bonus double-count)Cluster: MUS-BONUS-2026-09

Estimated loss

$36.9K

Affected users

Group joining is coming soon.

Investigation

75%

Facts and investigation

Ledger

Attacker

0x1a083ADf234a8f67ad65A9B9B616853ACf5998E5 (Ethereum EOA, confirmed by the SlowMist alert and the DeFiHackLabs PoC). Attack contract 0xD1a7A2A3c27962E80E9B6B46D54094F93267e988. Operator unknown.

Funds moved to

No outgoing transaction after the attack (Etherscan exports, Sep 15 - Oct 4). The contract returned 13.890654646 ETH to the EOA (2.836801 + 5.070290 + 5.947513 + 0.036050646) after the attacker sent it 10.7 ETH. Estimated balance on the EOA about 17.57 ETH (14.38 funding + 13.89 returned - 10.7 - 0.095 - fees), to be confirmed on the address page.

Linked

Victim contract 0x9bdf81e6066d32764b7e75a1b5577237e06d9364. Contract-creation transaction 0x7398889711dd1e1960dbef185bbe6cf7a3453b630cc9fdbf655ccc6a9e19f8fc; 'Run' transaction 0xc6116f5ffa7935f3b06f71fc13e3ab0bf5e09a2b1091a134c79619447ce456f2; attack transactions 0x905af4e8cdaf32c183605358c97181e9ad57393bd4ed1d945baf6d6eebe983fe, 0xaa172fcaa4800b14826daed1a78c9d6dcd8f26ae45ce5f31786d55768b709ec6 and 0xfe28118e48c64b275b587c90da472fc13b8c3dbed9d3cded1e18c1e7a7fc0392 (block 26087602). Funding: 0.09975 ETH from RAILGUN: Relay Adapt on Sep 15 at 16:16:11 UTC (then 0.095 ETH bridged out through LI.FI/Across), and 14.38 ETH from Relay: Solver (0xf70da97812cb96acdf810712aa562db8dfa3dbef) on Sep 30 at 03:10:59 UTC, 16 minutes 36 seconds before the attack; the origin of the Relay deposit was not retrieved (MISSING — manual recovery: the Relay page of transaction 0xe0c9cf6c31c014b2bcf7f8ab549f6237b0b901686ba806033a798f41c00c6454).

Chronology

1 beat

Sep 15, 2026: the attacker wallet is funded through Railgun and bridges 0.095 ETH out, then stays dormant for 15 days. Sep 30 at 03:10:59 UTC it receives 14.38 ETH from the Relay bridge solver. At 03:27:35 UTC (block 26087602) it deploys an attack contract and sends it 10.7 ETH; funded by a zero-fee Balancer V2 flash loan, the contract runs 16 deposit/withdraw cycles per transaction through fresh sub-address proxies. Each cycle nets 0.400167773791578324 ETH because the first-deposit bonus is both refunded and credited. The contract returns 13.890654646 ETH to the attacker, a net gain of about 3.19 ETH (about $8,600) after the 10.7 ETH injected; SlowMist's $36,900 corresponds to the gross 13.89 ETH. SlowMist flagged the incident at 05:25 UTC. As of Oct 4 the attacker wallet has made no further transaction. No project response was found.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)