Cardano

2026

Huma Finance

Polygon (Old)

Security

<ul>
 <li>A hacker took advantage of a legacy contract for Polygon royalties and drained $261,200 as a result of the vulnerability in the reward calculation.</li>
 <li>The security experts attributed the problem to flawed reward calculations leading to inflated ownership balances and exaggerated rewards.</li>
</ul>
A hacker used a legacy royalties contract on the Polygon platform and made away with about $261,200 worth of cryptocurrency in recent times. The security firm TenArmorAlert identified the unusual transaction on June 23 and tracked down the exploit transaction.
The blockchain shows that the hacker carried out the attack using the Polygon block 89,018,051 transaction. According to TenArmorAlert, the hacker managed to withdraw roughly $263,800 despite the relatively low initial amount of money. The attack was on the legacy royalties program and not the fundamental structure of the Polygon blockchain.
<div>
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨">TenArmor Security Alert<img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨"> Our system has detected a suspicious attack involving an old contract <a href="https://x.com/hashtag/Royalties?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Royalties</a> on <a href="https://x.com/hashtag/Polygon?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Polygon</a>, resulting in an approximately loss of $261.2K. Attack transaction: <a href="https://t.co/C2TTD661uK" rel="noopener noreferrer nofollow">https://t.co/C2TTD661uK</a> With TenArmor’s TenMonitor, you get early detection and… <a href="https://t.co/nlh0fhBan4" rel="noopener noreferrer nofollow">pic.twitter.com/nlh0fhBan4</a>— TenArmor <a href="https://x.com/TenArmorAlert/status/2069596801725002121?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 24, 2026</a>
 </blockquote>
</div>
<h3 class="wp-block-heading" id="h-miscalculation-in-reward-calculation-allowed-for-overdraws">Miscalculation in Reward Calculation Allowed for Overdraws</h3>
According to TenArmorAlert, the attack was possible due to issues in the reward calculation mechanism and reward accounting. Security company CertiK found out about an issue with the Royal1155LD.beforeLdaTransfer() function in the exploited contract.
<div>
 <blockquote class="twitter-tweet">
 <a href="https://x.com/hashtag/CertiKInsight?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#CertiKInsight</a><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨"> We have seen a $263K exploit on the Royalties contract at 0xfE16Ee78828672e86cf8E42d8A5119AB79877EC7 on Polygon. Through 100 zero-value transfers, the attacker exploited flawed settlement logic to stack reward records and claim 100X reward. Stay Vigilant! <a href="https://t.co/Jjt2yNwZUc" rel="noopener noreferrer nofollow">pic.twitter.com/Jjt2yNwZUc</a>— CertiK <a href="https://x.com/CertiKAlert/status/2069625284790505723?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 24, 2026</a>
 </blockquote>
</div>
Researchers state that the attacker made several zero-value transactions, manipulating reward calculation and ownership numbers. This vulnerability allowed the attacker to make the token balance higher under certain conditions.
The Defimon Alerts also provided other research by DecurityHQ. In this case, experts concluded that royalty miscalculations led to the exploit. This way, false ownership numbers were allowing for excessive reward claiming. In addition, the attacker used a flash loan to exploit this contract. After repaying the borrowed amount, the attacker got the rest of the money as a profit.
<div>
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨"><a href="https://x.com/join_royal?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@join_royal</a> – Loss $261K (2026-06-23) Token: <a href="https://x.com/search?q=%24USDC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$USDC</a> Network: Polygon Type: Logic Error (pro-rata royalty accounting) Royal's Royalties contract pays out claims as deposit × (LDA tier balance / tier supply). The attacker flash-loaned USDC, acquired an outsized tier-42 LDA…— Defimon Alerts (@DefimonAlerts) <a href="https://x.com/DefimonAlerts/status/2069651594807791979?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 24, 2026</a>
 </blockquote>
</div>
<h3 class="wp-block-heading" id="h-still-vulnerable-to-security-threats">Still Vulnerable to Security Threats</h3>
The latest attack has come in light of other similar attacks on older versions of decentralized finance projects as well as dormant smart contract deployments. Attackers have recently carried out an exploitation of some old contracts of Huma Finance and have stolen roughly $101,400.
Researchers have been cautioning developers regarding the possible dangers of having old versions of smart contracts with available finances. The team should audit, update, deactivate, or completely remove the old deployment in order to mitigate the danger of any potential attacks. Polygon developers have confirmed that attackers have not been able to threaten the security of the main blockchain network.
Highlighted Crypto News:
<a href="https://thenewscrypto.com/secondfi-exploit-exposes-wallet-keys-putting-more-than-20m-in-cardano-assets-at-risk/" rel="noopener noreferrer nofollow">‌SecondFi Exploit Exposes Wallet Keys, Putting More Than $20M in Cardano Assets at Risk&nbsp;</a>

Legacy Polygon Royalties Contract Exploit Drains $261K Through Reward Logic Flaw

Table of Contents

TheNewsCrypto

Other articles published on Jun 24, 2026

Join our free newsletter for daily crypto updates!