Hack history / 2026 / Hack or exploit
Scallop Lend
Hack or exploit on Apr 26, 2026 · Reward Logic Flaw
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$142K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,593
among thefts by dollars lost
What happened
Attacker exploited deprecated V2 contract from November 2023; uninitialized 'last_index' variable in rewards logic allowed unbounded claims. Using flashloan and oracle manipulation, attacker drained the sSUI rewards pool.
Details
- Date
- Apr 26, 2026
- Kind
- Hack or exploit
- Method
- Reward Logic Flaw
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Sui
After the theft
- Frozen
- yes, amount not stated
“The team promptly froze the affected contract, committed to covering 100% of the loss from treasury, and resumed normal operations.” (SlowMist Hacked)
Reported by
Related incidents
WEMIX.FI Lend 2026 · Hack or exploit · $737K
Bonzo Lend 2026 · Hack or exploit · $9.1M
Rhea Lend 2026 · Hack or exploit · $18.4M
Revert Lend 2026 · Hack or exploit · $50K
Zero To Lend 2025 · Costly mistake or other · $371K
Bonzo Lend 2026 · Hack or exploit · $9.1M
Rhea Lend 2026 · Hack or exploit · $18.4M
Revert Lend 2026 · Hack or exploit · $50K
Zero To Lend 2025 · Costly mistake or other · $371K
Cite this page
SwanBluechip, "Scallop Lend hack, Apr 26, 2026: $142K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht64e1be6bc9/ (data as of 2026-10-31).