MegaETH

Scallop

Robinhood

"Ain't no rest for the wicked."
The last weekend of April continued to be a restless one as back-to-back attacks and exploits came into light.&nbsp;
One of the most classic attempts at <a href="https://www.thestreet.com/crypto/tag/phishing-1" rel="noopener noreferrer nofollow">phishing</a> was exposed for Robinhood (Nasdaq: HOOD).&nbsp;
On April 26, multiple Robinhood customers <a href="https://x.com/JoelKatz/status/2048623679316406371?s=20" rel="noopener noreferrer nofollow">alerted</a> on X that they were receiving mail alerts from the official&nbsp;"noreply@robinhood.com."
The mail read a subject line "Your recent login to Robinhood." The mail would look like an alert on "Unrecognized Activity Detected on your Account" with a "Review Activity Now" clickable button.&nbsp;
Each of the mail read that there were changes detected in the user's account and the login device was an iPhone 17 Pro.&nbsp;
Users immediately alerted on X about the mails and soon the phishing attempt was revealed.&nbsp;
<a href="https://www.thestreet.com/crypto/technology/elon-musks-x-to-auto-lock-first-time-crypto-posts-to-curb-phishing" rel="noopener noreferrer nofollow">Related: Elon Musk’s X to auto-lock first-time crypto posts to curb phishing</a>
<h2 id="how-it-worked">How it worked</h2>
Attackers created or modified a Robinhood account in a way that allowed them to inject code or links into the device name field.&nbsp;
Robinhood's system then pulled that unfiltered field directly into its automated "recent login" email template.&nbsp;
As a result, users received legitimate-looking alerts that included a malicious "Review activity" button.&nbsp;
Clicking the link led to a fake login page that asked for usernames, passwords, and sometimes two-factor codes, giving attackers everything they needed for an account takeover.
Robinhood issued a warning on the same day, urging users to delete the emails and avoid clicking on suspicious links. For users who had already clicked and were facing trouble, Robinhood asked them to contact the company immediately.&nbsp;
Robinhood further&nbsp;<a href="https://x.com/AskRobinhood/status/2048649252352487683?s=20" rel="noopener noreferrer nofollow">wrote</a> on X,&nbsp;
<blockquote>
 "This phishing attempt was made possible by an abuse of the account creation flow. It was not a breach of our systems or customer accounts, and personal information and funds were not impacted."
</blockquote>
The phishing attempt also comes just two days before it announces its earnings for the first quarter of 2026. It is scheduled for April 28 after market hours.
A Robinhood spokesperson told TheStreet <a rel="noopener noreferrer nofollow">Roundtable</a>&nbsp;that&nbsp;affected customers had been directly notified, and the phishing campaign had been taken down. The spokesperson also noted that account flows had been strengthened to prevent this type of abuse from recurring.
On the question of account security, they clarified that direct account takeover was not possible through the email, pointing to Robinhood's multi-layered security measures, including two-factor authentication, device approval flows, and biometric verification.
<h2 id="crypto-chaos-continues-for-another-weekend">Crypto chaos continues for another weekend</h2>
The last two weekends have not been kind to crypto. From Drift exploit to KelpDAO, <a href="https://www.thestreet.com/crypto/tag/crypto-scam" rel="noopener noreferrer nofollow">malicious actors </a>continued attacking crypto projects and firms for the last weekend of April as well.
Robinhood was not the only one who experienced an exploit attempt on Sunday.
<h4>Purrlend:&nbsp;</h4>
Lending protocol Purrlend paused operations on April 25, Saturday, after detecting irregular activity across its deployments on MegaETH and HyperEVM. These are two newer, speed-focused blockchain networks.&nbsp;
MegaETH is an Ethereum layer-2 backed by co-founder Vitalik Buterin that launched its public mainnet in February. HyperEVM is the smart contract layer of Hyperliquid, a blockchain built primarily for trading.&nbsp;
Purrlend runs on both as a lending platform, where users deposit crypto to earn interest or borrow against their holdings.
Attackers drained roughly $1.2 million from HyperEVM, mostly dollar-pegged stablecoins, including 449,683 USDC, 214,125 USDT0, and 194,745 USDH, plus smaller amounts of tokenized Bitcoin and wrapped tokens.&nbsp;
MegaETH lost another $324,549 in USDT0, WETH, and USDm. Total losses were approximately $1.52 million.
The exploiter's wallet addresses are visible on both networks' public block explorers. But no funds have been recovered.
<h2 id="more-from-thestreet-roundtable">More from TheStreet Roundtable:</h2>
<ul>
 <li><a href="https://www.thestreet.com/crypto/markets/major-defi-hack-becomes-the-largest-of-2026-yet" rel="noopener noreferrer nofollow">Major DeFi hack becomes the largest of 2026 yet</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/gold-giant-freezes-344-million-tied-to-illicit-activity" rel="noopener noreferrer nofollow">Tether freezes $344 million tied to illicit activity</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/treasury-secretary-bessent-introduces-new-plan-to-combat-money-laundering" rel="noopener noreferrer nofollow">Treasury Secretary Bessent introduces new plan to combat money laundering</a></li>
</ul>
<h4>Litecoin:</h4>
On Saturday, a few hours later, Litecoin's network underwent a 13-block reorganization after a zero-day vulnerability was exploited.&nbsp;
A reorganization (or "reorg") is when the network backtracks and rewrites recent blocks or transactions on the blockchain.
A zero-day vulnerability is a flaw that no one knew existed until someone exploited it.&nbsp;
Attackers figured out such a vulnerability in Litecoin's MimbleWimble Extension Block (MWEB) privacy layer. It is&nbsp;a feature Litecoin added to let users send transactions more privately, hiding amounts and addresses.
The bug was patched within hours, as <a href="https://x.com/litecoin/status/2048135554445832542?s=20" rel="noopener noreferrer nofollow">alerted</a> by the Litecoin team on X. Although no funds were permanently stolen, the event exposed coordination gaps and raised questions about the security of newer features among some users.&nbsp;
<h4>Scallop (Sui):&nbsp;</h4>
Scallop, Sui's largest lending protocol, suffered an exploit on Sunday. This resulted in approximately $140,000 in losses.&nbsp;
Following the breach, the Scallop team froze affected contracts, identified the vulnerability, and restored operations. User deposits remained unaffected.&nbsp;
The attacker targeted an old and forgotten V2 contract deployed in November 2023 that remained accessible on-chain under Sui's immutable design.&nbsp;
Rather than using standard SDK pathways, they interacted directly with the older contract version.&nbsp;
By staking 136,000 sSUI&nbsp;(a staked version of Sui's native token), the attacker manipulated the system's verification logic to receive massively inflated rewards, effectively draining the side pool.&nbsp;
Additionally, the attacker briefly tampered with Scallop's price feeds, skewing SUI/USDC rates to borrow assets cheaply before repaying a flash loan in a single transaction block.&nbsp;
The attacker has reportedly offered to return 80% of the funds in exchange for a bounty, though Scallop has not yet confirmed an agreement.
Scallop later <a href="https://x.com/Scallop_io/status/2048412464384241689?s=20" rel="noopener noreferrer nofollow">announced</a> the unfreezing of the core contracts and assured that the user deposits and funds remain unimpacted. Withdrawals and deposits are now operating normally.
SUI Foundation told TheStreet <a rel="noopener noreferrer nofollow">Roundtable</a>&nbsp;that the recent Scallop exploit and the <a href="https://www.thestreet.com/crypto/markets/another-defi-company-loses-millions-in-fresh-exploit" rel="noopener noreferrer nofollow">Volo Protocol exploit</a> on Sui that took place a couple of days earlier were "not caused by any issue with the Sui network or its underlying protocol."
<blockquote>
 "Sui Foundation engaged immediately to support both teams and coordinate response efforts."
</blockquote>
TheStreet&nbsp;<a rel="noopener noreferrer nofollow">Roundtable</a> has also reached out to Purrlend, Litecoin, and Scallop for comments and has not received responses at the time of publication.&nbsp;
<a href="https://www.thestreet.com/crypto/markets/major-defi-hack-becomes-the-largest-of-2026-yet" rel="noopener noreferrer nofollow">Related: Major DeFi hack becomes the largest of 2026 yet</a>

Robinhood suffers phishing attempt ahead of quarterly earnings

Table of Contents

TheStreet Roundtable

Other articles published on Apr 27, 2026

Join our free newsletter for daily crypto updates!