Hack history / 2026 / Hack or exploit
Enjin
Hack or exploit on Aug 26, 2026 · Ownership Takeover
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$162K
sources: $142K to $162K
Returned
none listed
as the sources state it
Rank
#1,560
among thefts by dollars lost
What happened
Enjin’s legacy CryptoItems infrastructure was exploited through a storage-slot collision between a registered adapter and its Managed Delegate Proxy. Because adapter functions execute in the proxy’s storage context via DELEGATECALL, the attacker called the adapter’s public initialize(uint256), which wrote the attacker’s address into the proxy’s pendingManager storage slot. The attacker then called acceptManager(), gained managerial control, registered a malicious adapter, stole ENJ-backed assets from users, and liquidated them through melt().
Details
- Date
- Aug 26, 2026
- Kind
- Hack or exploit
- Method
- Ownership Takeover
- How in
- Smart contract bug
- Target
- NFTfi
- Chains
- Ethereum
Reported by
Related incidents
Cite this page
SwanBluechip, "Enjin hack, Aug 26, 2026: $162K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht6684ab6954/ (data as of 2026-10-31).