Hack history / 2026 / Hack or exploit
Flamincome
Hack or exploit on Sep 16, 2026 · Spot Price Manipulation
IN REVIEWSOURCES DISAGREE ON DATE OR LOSS · 3 SOURCES
Lost
$346K
sources: $346K to $595K
Returned
none listed
as the sources state it
Rank
#1,271
among thefts by dollars lost
What happened
Flamincome’s VaultYUSDT strategy valued its Convex-staked Curve USDP LP position using the strategy’s BaseRewardPool.balanceOf() multiplied by Curve’s spot get_virtual_price(). The attacker used approximately $18M USDT of Morpho flash liquidity to acquire USDP and imbalance-mint USDP metapool LP, then permissionlessly staked LP for the strategy through Convex. This temporarily increased the strategy’s reported holdings/NAV. VaultYUSDT immediately incorporated the manipulated valuation into its share price, allowing the attacker to redeem shares at an inflated value and force the strategy to withdraw real aUSDT liquidity from Aave
In review: possible duplicate within one source; sources disagree on the loss.
Details
- Date
- Sep 16, 2026
- Kind
- Hack or exploit
- Method
- Spot Price Manipulation
- How in
- Price, oracle and governance
- Target
- DeFi protocol
- Chains
- Ethereum
Reported by
Related incidents
Flamincome 2026 · Hack or exploit · $346K
Rhea Lend 2026 · Hack or exploit · $18.4M
Blend Pools V2 2026 · Hack or exploit · $10.2M
Bonzo Lend 2026 · Hack or exploit · $9.1M
Moonwell Lending 2026 · Hack or exploit · $8.7M
Rhea Lend 2026 · Hack or exploit · $18.4M
Blend Pools V2 2026 · Hack or exploit · $10.2M
Bonzo Lend 2026 · Hack or exploit · $9.1M
Moonwell Lending 2026 · Hack or exploit · $8.7M
Cite this page
SwanBluechip, "Flamincome hack, Sep 16, 2026: $346K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htcf34e0fc00/ (data as of 2026-10-31).