A software defect introduced during a June 2023 code refactor was exploited on August 31, 2026, resulting in the loss of approximately $1.3 million. The attacker executed 26 transactions to drain funds by gaining unauthorized access to vault references within the Radix Engine, a vulnerability that remained undetected during a 2024 audit by Zellic.
The incident forced a ten-day halt in network transactions while developers implemented a patch. Operations resumed on September 11, 2026, after the fix was deployed. The compromised funds were moved via the Hyperlane bridge, though no private keys were exposed during the exploit.
Key facts
- The vulnerability originated from a code refactor completed in June 2023.
- An attacker drained roughly $1.3 million through 26 unauthorized transactions on August 31, 2026.
- The exploit targeted vault references in the Radix Engine without compromising private keys.
- A 2024 security audit conducted by Zellic failed to identify the specific defect.
- Stolen assets were transferred out using the Hyperlane bridge protocol.
- Network transactions were paused for ten days before resuming on September 11, 2026.
Why it matters
This event highlights the long-term risks associated with software refactoring and the limitations of periodic security audits in catching dormant bugs. The significant downtime required to patch the issue demonstrates how deep-seated engine-level vulnerabilities can disrupt network availability and erode user confidence, even when cryptographic credentials remain secure.