Hack history / 2026 / Hack or exploit
Huma
Hack or exploit on May 11, 2026 · Improper Access Control
ATTACK TX CONFIRMED ON CHAINSOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$101K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,704
among thefts by dollars lost
What happened
Huma Finance's deprecated V1 BaseCreditPool contracts on Polygon were exploited via a credit-lifecycle logic error combined with unrestricted access control. An attacker created Requested credit records through an open requestCredit() path with preApproved=false, then advanced those unapproved records to GoodStanding using an unrestricted refreshAccount() call. The attacker then exploited drawdown() to borrow the pools' residual balances.
Details
- Date
- May 11, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Polygon
Reported by
Related incidents
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "Huma hack, May 11, 2026: $101K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htca4686f2f0/ (data as of 2026-11-01).