Hack history / 2026 / Hack or exploit
X7 Finance
Hack or exploit on Oct 8, 2026 · Smart Contract Vulnerability
ONE SOURCE · 1 SOURCE
Lost
$17K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,171
among thefts by dollars lost
What happened
An attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.
Details
- Date
- Oct 8, 2026
- Kind
- Hack or exploit
- Method
- Smart Contract Vulnerability
- How in
- Smart contract bug
- Target
- not stated
- Chains
- Ethereum
Reported by
Related incidents
RsETHSafeModule 2026 · Hack or exploit · $7.7M
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
Butter Bridge 2026 · Hack or exploit · $180K
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
Butter Bridge 2026 · Hack or exploit · $180K
Cite this page
SwanBluechip, "X7 Finance hack, Oct 8, 2026: $17K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htdc8d838bc4/ (data as of 2026-10-31).