Hack history / 2026 / Hack or exploit
Lumi Finance
Hack or exploit on Jul 13, 2026 · Signature Verification Flaw
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$270K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,359
among thefts by dollars lost
What happened
On July 13, 2026, Lumi Finance on Arbitrum lost ~$270K through Sodium smart account ERC-1271 validation flaws. The exploit required two bugs: (1) Sodium accepted attacker-controlled contracts as valid signers and session keys, and (2) validateUserOp granted unlimited ERC-20 allowances via attacker-controlled paymasterAndData. Attackers systematically stripped tokens from user accounts, leaving persistent allowances.
Details
- Date
- Jul 13, 2026
- Kind
- Hack or exploit
- Method
- Signature Verification Flaw
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Arbitrum
Reported by
Related incidents
Wanchain 2026 · Hack or exploit · $10M
Gnosis Pay 2026 · Hack or exploit · $1.5M
Nimiq 2026 · Hack or exploit · $50K
Lixir Finance 2026 · Hack or exploit · $12K
Mure 2026 · Hack or exploit · $12K
Gnosis Pay 2026 · Hack or exploit · $1.5M
Nimiq 2026 · Hack or exploit · $50K
Lixir Finance 2026 · Hack or exploit · $12K
Mure 2026 · Hack or exploit · $12K
Cite this page
SwanBluechip, "Lumi Finance hack, Jul 13, 2026: $270K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht4c01bbec2a/ (data as of 2026-11-01).