Hack history / 2026 / Hack or exploit
Demex Perp
Hack or exploit on Sep 25, 2026 · Cross-Chain Message Spoofing
ONE SOURCE · 1 SOURCE
Lost
$192K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,504
among thefts by dollars lost
What happened
Demex’s bridge was exploited through insufficient verification between its bridge module and external-chain contract system. The attacker used a helper contract to falsify token-deployment reports, registering the low-value nLEND token against canonical WETH and WBNB contracts. Subsequent withdrawals released approximately $191,929 in bridge reserves despite deducting only $10.47 worth of nLEND. The withdrawal limiter also failed because it valued the deducted tokens rather than the assets released
Details
- Date
- Sep 25, 2026
- Kind
- Hack or exploit
- Method
- Cross-Chain Message Spoofing
- How in
- Bridge and cross-chain
- Target
- DeFi protocol
- Chains
- Demex, Ethereum, BNB Chain
Reported by
Related incidents
Rocket Perp 2026 · Hack or exploit · $288K
Typus Perp 2025 · Hack or exploit · $3.4M
Demex 2025 · Hack or exploit · $951K
Kelp 2026 · Hack or exploit · $293M
CrossCurve 2026 · Hack or exploit · $3M
Typus Perp 2025 · Hack or exploit · $3.4M
Demex 2025 · Hack or exploit · $951K
Kelp 2026 · Hack or exploit · $293M
CrossCurve 2026 · Hack or exploit · $3M
Cite this page
SwanBluechip, "Demex Perp hack, Sep 25, 2026: $192K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht53ae1f8521/ (data as of 2026-10-31).