Hack history / 2026 / Hack or exploit
Aquifer
Hack or exploit on Aug 31, 2026 · Arbitrary External Call
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$2.5M
dollars at the time
Returned
none listed
as the sources state it
Rank
#640
among thefts by dollars lost
What happened
Aquifer allowed the caller to supply the input-side token program used during swaps instead of pinning it to the canonical SPL Token Program. The attacker supplied a malicious program that accepted Aquifer’s CPI transfer instruction and returned success without transferring the required input tokens. Aquifer failed to verify the actual input-token balance increase and consequently released real output tokens from its vaults without receiving payment
Details
- Date
- Aug 31, 2026
- Kind
- Hack or exploit
- Method
- Arbitrary External Call
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Solana
Reported by
Related incidents
IPOR Fusion 2026 · Hack or exploit · $336K
Quant 2026 · Hack or exploit · $138K
ShapeShift FOX Colony 2026 · Hack or exploit · $133K
Custom sAVAX Rebalancer 2026 · Hack or exploit · $64K
ether.fi Liquid 2026 · Hack or exploit · $43K
Quant 2026 · Hack or exploit · $138K
ShapeShift FOX Colony 2026 · Hack or exploit · $133K
Custom sAVAX Rebalancer 2026 · Hack or exploit · $64K
ether.fi Liquid 2026 · Hack or exploit · $43K
Cite this page
SwanBluechip, "Aquifer hack, Aug 31, 2026: $2.5M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht4eefd15699/ (data as of 2026-10-31).