Hack history / 2022 / Hack or exploit
XCarnival
Hack or exploit on Jun 26, 2022 · Deposit Logic Flaw
ATTACK TX CONFIRMED ON CHAINSOURCES AGREE ON DATE AND LOSS · 4 SOURCES
Lost
$3.8M
dollars at the time
Returned
$1.9M
50% of the loss, as a source states it
Rank
#529
among thefts by dollars lost
What happened
On June 26, 2022, XCarnival NFT lending protocol was exploited via a vulnerability in collateral tracking where the orderID remained open after withdrawal. The attacker generated multiple contract addresses, used the same BAYC NFT as collateral, and repeated the deposit-borrow-withdraw cycle to obtain an infinite number of loans, siphoning 3,087 ETH (~$3.8M).
Details
- Date
- Jun 26, 2022
- Kind
- Hack or exploit
- Method
- Deposit Logic Flaw
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum
After the theft
- Returned by the attacker
- yes, amount not stated
“The NFT liquidity solver XCarnival was attacked, the hacker made a profit of 3,087 ETH (about 3.8 million US dollars), and the hacker has returned 1,467 ETH after the negotiation.” (SlowMist Hacked) - Recovered or frozen
- $1.9M
“$3.8M taken, $1.9M after recovery or freezing” (Web3 Is Going Great)
Related incidents
Cite this page
SwanBluechip, "XCarnival hack, Jun 26, 2022: $3.8M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht5abba944a1/ (data as of 2026-11-01).