Notional Finance (2026) — Crypto Hack
ConfirmedNotional Finance lost ~$1.7M via an integer overflow / unsafe uint128 downcast in the free-collateral calculation of its legacy V1 escrow contract. The stolen funds were converted to ~689 ETH and sent to Tornado Cash.
Summary
Notional Finance lost ~$1.7M via an integer overflow / unsafe uint128 downcast in the free-collateral calculation of its legacy V1 escrow contract. The stolen funds were converted to ~689 ETH and sent to Tornado Cash.
How It Was Compromised — DeFi via Integer Overflow / Unsafe uint128 Downcast
On September 4, 2026, Notional Finance suffered a ~$1.7M exploit stemming from an integer overflow / unsafe uint128 downcast in the free-collateral calculation of its legacy V1 escrow contract. The vulnerability allowed the attacker to manipulate the free-collateral accounting and extract funds from the escrow. The stolen assets were converted to approximately 689 ETH and subsequently deposited into the Tornado Cash mixer.
Fund Flow & Laundering Analysis
The stolen funds were converted to approximately 689 ETH and sent to the Tornado Cash mixer to obscure the trail.