Hack history / 2026 / Hack or exploit
GoldPesa
Hack or exploit on Oct 2, 2026 · Incorrect Share Accounting
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$115K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,672
among thefts by dollars lost
What happened
GoldPesa’s GPXHooks rebalanced protocol-owned GPX/USDC liquidity through Uniswap v4’s shared PositionManager without ensuring its currency deltas were isolated and settled. An attacker created an unpaid WETH/USDC position within the same PoolManager unlock and then triggered GoldPesa’s hourly rebalance. Because TAKE_PAIR operated on the PositionManager’s net credit, GoldPesa’s legitimate USDC credit offset the attacker’s outstanding debt, allowing the attacker to burn their position and withdraw the resulting USDC. Uniswap v4 itself behaved as designed
Details
- Date
- Oct 2, 2026
- Kind
- Hack or exploit
- Method
- Incorrect Share Accounting
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Base
Reported by
Related incidents
Fence Finance 2026 · Hack or exploit · $1M
CometDEX 2026 · Hack or exploit · $717K
BCE-USDT liquidity pool 2026 · Hack or exploit · $679K
BlueMove DEX 2026 · Hack or exploit · $529K
mySwap CL 2026 · Hack or exploit · $305K
CometDEX 2026 · Hack or exploit · $717K
BCE-USDT liquidity pool 2026 · Hack or exploit · $679K
BlueMove DEX 2026 · Hack or exploit · $529K
mySwap CL 2026 · Hack or exploit · $305K
Cite this page
SwanBluechip, "GoldPesa hack, Oct 2, 2026: $115K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htcc3002b357/ (data as of 2026-10-31).