Namada Shielded Pools — MASP Drained via IBC Behind a Stale Indexer — Silent Hack Discovered by F12 Security

Timeline: T0 (drain occurs some time before public disclosure, most likely 2026-06-18 given DeFiLlama's TVL snapshot of $594,381 recorded that day, collapsing to near-zero by the following day): Attacker(s) drain the liquid IBC-transferable assets (ATOM, USDC, OSMO, TIA, NYM) from Namada's Multi-Asset Shielded Pool (MASP), leaving staked/LSD assets (NAM, stATOM, stTIA, stOSMO, NTRN, Penumbra) untouched. The drain goes undetected by the public-facing block explorer/indexer, which continues to display pre-drain balances. T+public discovery (2026-06-19, 23:15 UTC): F12 Security (@f12sec) publishes the first public disclosure on X, stating Namada's MASP had been drained of ~$600K and that 'nobody noticed' because the indexer showed stale (pre-drain) balances while the live RPC confirmed a true balance of zero. T+minutes: F12 follows up with a token-by-token before/after comparison (indexer figure → live RPC figure) for ATOM, USDC, OSMO, TIA, and NYM, noting that staked assets were left untouched. T+minutes: F12 explains the underlying technical proof for non-technical readers — the raw RPC response's base64-encoded 'AAAA...=' value decodes to all-zero bytes, i.e., balance = 0, whereas a genuinely funded pool would return a real non-zero encoded string. F12 publishes the exact public contract/token addresses used to independently verify the finding via direct RPC query. T+2026-06-20: F12 provides further corroboration, noting that DeFiLlama (which also pulls its TVL data from Namada's live RPC, independent of the stale indexer) showed the same TVL collapse from ~$600K to near-zero over the same period — used by F12 as third-party proof against a community member's suggestion that the discrepancy might be a temporary infrastructure/indexer outage rather than an actual drain. A separate user reports being personally unable to withdraw OSMO holdings from the MASP, corroborating real user impact. Status as of report compilation: incident considered confirmed and unresolved; no official statement, root-cause disclosure, or remediation plan from the Namada project team has been identified in available sources; attacker identity and destination of drained funds remain unknown.