Hack history / 2026 / Hack or exploit
X7Finance
Hack or exploit on Oct 8, 2026 · X7Pioneer's claimRewards() adds the unaccounted ETH balance delta into totalRewards on every call but only refreshes lastETHBalance when claimable is non-zero, so calling it with an empty tokenIds array re-counts the same donated delta each time and inflates the per-token reward until a single owned
ONE SOURCE · 1 SOURCE
Lost
$17K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,164
among thefts by dollars lost
What happened
No description from DefiLlama or SlowMist; see the sources below.
Details
- Date
- Oct 8, 2026
- Kind
- Hack or exploit
- Method
- X7Pioneer's claimRewards() adds the unaccounted ETH balance delta into totalRewards on every call but only refreshes lastETHBalance when claimable is non-zero, so calling it with an empty tokenIds array re-counts the same donated delta each time and inflates the per-token reward until a single owned
- How in
- Smart contract bug
- Target
- not stated
- Chains
- not stated
Reported by
- DeFiHackLabs exploit reproduction only
Cite this page
SwanBluechip, "X7Finance hack, Oct 8, 2026: $17K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht15761e9805/ (data as of 2026-11-01).