Incident case file
Sign in to watchScallop Lend — Deprecated V2 Rewards Contract Flash Loan Exploit
0 views
Estimated loss
Victims identified
Investigation
Facts and investigation
Attacker: Sui address tied to tx hash 6WNDjCX3W852hipq6yrHhpUaSFHSPWfTxuLKaQkgNfVL — full address TODO
Timeline: April 26, 2026, 12:50 UTC: Scallop discloses incident on X and freezes affected contract. Attacker exploited the deprecated V2 rewards contract whose last_index variable was never initialized for new staking accounts, causing the contract to treat the attacker position as 20 months old. Attacker deposited ~136,000 sSUI; was credited with ~162 billion reward points; exchanged for ~150,000 SUI. In a single block, briefly tampered with SUI/USDC oracle to amplify gains via flash loan. Funds bridged through Sui privacy mixer. Same day: Scallop team confirms 100% user coverage. April 27: Scallop unfreezes core; attacker reportedly contacts team offering 80% white-hat return.
Sources and coverage
- Articleforklog.comhttps://forklog.com/en/hacker-steals-150k-sui-from-scallop-lend/
- Articlefinance.yahoo.comhttps://finance.yahoo.com/news/scallop-lend-falls-victim-150k-120000.html
- Articlemexc.comhttps://www.mexc.com/news/1054845
- Articlemoneycheck.comhttps://moneycheck.com/scallop-protocol-suffers-142k-loss-after-exploiter-drains-deprecated-sui-contract
- Articlecryptotimes.iohttps://www.cryptotimes.io/2026/04/27/scallop-loses-142k-in-flash-loan-attack-on-deprecated-contract/
- Articleblocksec.comhttps://blocksec.com/blog/defi-exploit-analysis-root-cause-euler-s-200m
Victim testimonies
No testimonies yet.
+ Add my testimony → (coming soon)