Hack history / 2026 / Hack or exploit
DoinGud
Hack or exploit on Sep 21, 2026 · Swap Logic Flaw
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$35K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,006
among thefts by dollars lost
What happened
DoinGud’s acceptOffer settlement logic transferred an offer’s USDC price to the caller without deleting or zeroing the consumed offer record. Unlike cancelOffer, the acceptance path omitted the swap-and-pop cleanup. Missing checks also permitted the offerer to accept their own offer and permitted a zero NFT amount. By using amount=0, the attacker avoided listing cleanup and replayed identical acceptOffer calldata, causing the contract to pay the same offer repeatedly. A flash loan supplied the temporary USDC needed to construct the self-funded offer. Independent reporting likewise describes the exploit as failure to clear a bid after acceptance
Details
- Date
- Sep 21, 2026
- Kind
- Hack or exploit
- Method
- Swap Logic Flaw
- How in
- Smart contract bug
- Target
- NFTfi
- Chains
- Polygon
Reported by
Related incidents
DefiTuna Lending 2026 · Hack or exploit · $580K
GoonFi 2026 · Hack or exploit · $254K
Balancer V1 2026 · Hack or exploit · $250K
ATM 2026 · Hack or exploit · $244K
SKYDAO 2026 · Hack or exploit · $183K
GoonFi 2026 · Hack or exploit · $254K
Balancer V1 2026 · Hack or exploit · $250K
ATM 2026 · Hack or exploit · $244K
SKYDAO 2026 · Hack or exploit · $183K
Cite this page
SwanBluechip, "DoinGud hack, Sep 21, 2026: $35K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htd8fd87b022/ (data as of 2026-10-31).