Hack history / 2026 / Hack or exploit
MetaSea
Hack or exploit on May 17, 2026 · Withdrawal Logic Flaw
ONE SOURCE · 1 SOURCE
Lost
$110K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,682
among thefts by dollars lost
What happened
MetaSea's redeemPosition function overpaid SEA yield from a shared distributor without blocking just-in-time openings and redemptions in the same block. An attacker used Aave flash loans to atomically deposit USDT into the settlement adapter, redeem disproportionately large SEA amounts (17-27M vs 1.2M input), and sell the SEA back for USDT. Running 8 identical attacks back-to-back, the attacker extracted $110K aggregate across multiple blocks.
Details
- Date
- May 17, 2026
- Kind
- Hack or exploit
- Method
- Withdrawal Logic Flaw
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Arbitrum
Reported by
Related incidents
TAC 2026 · Hack or exploit · $7.5M
Sweat Foundation 2026 · Hack or exploit · $3.5M
Maya Protocol 2026 · Hack or exploit · $1.7M
Allbridge Core 2026 · Hack or exploit · $1.6M
Aftermath Perps 2026 · Hack or exploit · $1.1M
Sweat Foundation 2026 · Hack or exploit · $3.5M
Maya Protocol 2026 · Hack or exploit · $1.7M
Allbridge Core 2026 · Hack or exploit · $1.6M
Aftermath Perps 2026 · Hack or exploit · $1.1M
Cite this page
SwanBluechip, "MetaSea hack, May 17, 2026: $110K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htd5f6a89dad/ (data as of 2026-10-31).