Hack history / 2026 / Hack or exploit
YieldCore-3rd-deal
Hack or exploit on Apr 28, 2026 · Improper Access Control
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$399K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,224
among thefts by dollars lost
What happened
YieldCore's RWAVault overrode ERC4626 withdraw() and redeem() functions but removed the standard authorization check when msg.sender ≠ owner. Any caller could specify an arbitrary depositor as owner and direct withdrawn assets to an arbitrary receiver. An attacker drained 392,764 USDC of principal from eight depositors across multiple calls.
Details
- Date
- Apr 28, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum
Reported by
Related incidents
Tokens notionally worth $825,000 stolen from Syntropy in venture capital investment deal gone wrong 2022 · Hack or exploit · $825K
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
Cite this page
SwanBluechip, "YieldCore-3rd-deal hack, Apr 28, 2026: $399K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht06193a4952/ (data as of 2026-11-01).