Ethereum

Thetanuts Finance

when

Carry

Real

Thetanuts Finance was hit by a roughly $2.1 million exploit on Ethereum after an attacker abused a legacy vault accounting flaw, while around $2 million in positions appear to have been secured by a whitehat.
The attack centered on an old Thetanuts vault contract rather than the protocol’s current live products. Thetanuts said the affected vault was deprecated years ago and had no relation to its current contracts or products, with a full post-mortem still expected after the team completes its investigation.
The <a href="https://etherscan.io/tx/0xbba9f138fe39503bfd1aa62932dbd6ab35d37d23d48e4b7bf2988a9d5dc39fec" rel="noopener noreferrer nofollow">exploit transaction</a> was followed by a separate <a href="https://etherscan.io/tx/0x4c0a75e27855f350c95e3dc64906b1b2f19e6649fdfd0d9374f3915067418bc1" rel="noopener noreferrer nofollow">whitehat rescue transaction</a>, which Etherscan labels through ThetanutsFi whitehat addresses. The whitehat action appears to have protected a large portion of the exposed option-token positions before the exploit could expand further.
PeckShield placed the total incident size near $2.1 million and said about $2 million in option tokens appeared to have been whitehatted. The exploiter swapped about $105,000 in USDC for roughly 60 ETH and still held around $34,000 in USDC-denominated option tokens after the initial attack flow.
<h2 id="rounding-bug-let-the-attacker-mint-almost-for-free">Rounding Bug Let The Attacker Mint Almost For Free</h2>
The exploit path involved a math edge case in the vault’s minting and claiming logic. After <code>claim(uint256)</code> drained the vault toward a near-zero total supply, the <code>mint(uint256)</code> calculation rounded down in a way that allowed the required deposit amount to evaluate to zero.
The vulnerable logic followed a formula similar to <code>depositAmount = vault.balance * amount / totalSupply</code>. When total supply was pushed into an extreme low-supply state, integer division truncation turned the deposit requirement into zero for certain inputs. That opened a path for repeated free or near-free minting, letting the attacker create claims against vault value without putting in the required backing.
This was not a private-key compromise or a normal token approval drain. It was a contract-accounting failure, where a small rounding behavior became dangerous because the attacker could manipulate supply conditions first, then mint against broken math.
The pattern is similar to other DeFi failures where low liquidity, low supply or edge-case accounting turns a normal formula into an attack surface. CryptoAdventure’s recent <a href="https://cryptoadventure.com/aztec-connect-investigates-potential-2-1m-exploit-on-deprecated-contract/" rel="noopener noreferrer nofollow">Aztec Connect exploit story</a> raised a related issue: deprecated or legacy contracts can still hold real value, even when teams have moved active products elsewhere.
<h2 id="deprecated-contracts-still-carry-real-risk">Deprecated Contracts Still Carry Real Risk</h2>
Thetanuts’ current contracts may not be connected to the affected vault, but the incident shows why old deployed code remains a live risk on Ethereum. Smart contracts do not disappear when a protocol migrates away from them. If value, approvals, option tokens or claim paths remain attached to old contracts, attackers can still search them for exploitable edge cases.
That risk is especially sharp in structured-product protocols. Options vaults, index tokens and LP-style accounting often rely on supply, backing, settlement and redemption math. A rounding issue that looks minor under normal conditions can become severe when an attacker uses flash liquidity or repeated calls to force the system into an abnormal state.
The whitehat rescue kept the incident from becoming a cleaner full drain, but the remaining confirmed exploit flow still leaves Thetanuts with a post-mortem to deliver. Users will be watching for the exact affected vault, the status of rescued assets, whether any user funds remain at risk, and how the team plans to handle legacy contract exposure after the incident.
The post <a href="https://cryptoadventure.com/thetanuts-hit-by-2-1m-legacy-vault-exploit-as-whitehat-secures-most-funds/" rel="noopener noreferrer nofollow">Thetanuts Hit By $2.1M Legacy Vault Exploit As Whitehat Secures Most Funds</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Thetanuts Hit By $2.1M Legacy Vault Exploit As Whitehat Secures Most Funds

Table of Contents

Crypto Adventure

Other articles published on Jun 16, 2026

Join our free newsletter for daily crypto updates!