Hack history / 2026 / Hack or exploit
LootBot AI
Hack or exploit on Apr 15, 2026 · Smart Contract Vulnerability
ONE SOURCE · 1 SOURCE
Lost
$10K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,262
among thefts by dollars lost
What happened
LootBot AI’s xLoot NFT Staking contract was exploited via a Logic Error (Duplicate NFT ID in Redemption). The redeem() function did not validate duplicate token IDs in the input array. The _redeemable() logic accumulated ETH rewards per epoch for each ID without checking for duplicates, and the nextRedeem mapping was only updated after payout. The attacker flash-loaned 2.1 ETH, triggered a new epoch, called redeem() with 7 NFT IDs each duplicated 155 times, draining ~6.21 ETH. After repaying the flash loan, net profit was ~4.1 ETH ($9,600). The project appears largely abandoned (last official X activity in 2025).
Details
- Date
- Apr 15, 2026
- Kind
- Hack or exploit
- Method
- Smart Contract Vulnerability
- How in
- Insiders: rug pulls, frauds, collapses
- Target
- not stated
- Chains
- not stated
Reported by
Related incidents
RsETHSafeModule 2026 · Hack or exploit · $7.7M
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
Butter Bridge 2026 · Hack or exploit · $180K
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
Butter Bridge 2026 · Hack or exploit · $180K
Cite this page
SwanBluechip, "LootBot AI hack, Apr 15, 2026: $10K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht69d6466208/ (data as of 2026-10-31).