Thetanuts Finance Legacy Vault Exploit — Whitehat Recovery

Timeline: On June 15, 2026, an attacker exploited Thetanuts Finance's deprecated legacy Index Vault by using a flash loan to drive the vault's totalSupply close to zero, then abusing the resulting division-by-near-zero in the redemption formula (backing x amount / totalSupply) to mint and redeem disproportionate payouts. The attacker drained approximately $2.1M in option tokens via transaction 0xbba9f138fe39503bfd1aa62932dbd6ab35d37d23d48e4b7bf2988a9d5dc39fec from victim contract 0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7. PeckShieldAlert issued the first public alert the same day, noting that approximately $2M of the drained option tokens had already been whitehatted. Blockaid's community alert independently confirmed the exploiter and contract addresses. Thetanuts Finance confirmed on X: 'this is once again, a deprecated vault that we have migrated from years ago. It has no relation to any of our current contracts or products.' Security researcher ExVul published the technical root-cause breakdown the same day: 'The root cause is a flaw in the legacy vault's redemption math, which used a backing * amount / totalSupply formula to calculate share payouts, allowing the attacker to withdraw more funds than they were entitled to.' The attacker swapped the retained $105K USDC portion for approximately 60 ETH; the whitehat-recovered $2M was returned to the protocol. No formal attribution has been made by any security firm.