Incident statement: vault funds withdrawn on 29 September 2026
On 29 September 2026 an outside party withdrew all 766.20 USDC held in the Polystream vault, using a flaw in our smart contract. The vault is no longer safe to use, so deposits are paused. We found no evidence that any customer wallet or login was accessed. We are preparing refunds for every affected customer. You do not need to do anything.
What happened
The vault is a smart contract on the Scroll network. When customers deposited, the contract issued them shares, and when they withdrew it burned shares and paid out USDC.
The withdraw function had a flaw. It paid out the requested amount first, and then burned the shares, but it capped the burn at however many shares the caller owned. It did not check that the shares covered the payout. Separately, the function that creates shares was open to anyone.
The attacker created a single, tiny share (it cost 0.000002 USDC), then asked to withdraw the entire pool in one call. The contract paid out the full amount and burned only that one tiny share. The shares that customers hold were not touched, but with the pool empty they are now worth nothing.
Timeline (UTC)
| Time | Event |
|---|---|
| 29 Sep, 11:53 | An unknown wallet receives about 7.57 USDC. |
| 29 Sep, 12:04 | The same wallet makes a normal 2 USDC deposit through the app's deposit contract. |
| 29 Sep, 14:58:28 | It creates one tiny vault share. Transaction |
| 29 Sep, 14:58:48 | It withdraws the entire pool (766.202108 USDC) and burns that one share. Transaction |
| 29 Sep, 15:02:30 | It sends 771 USDC out of Scroll through a cross-chain bridge. Transaction |
Malaysia time is UTC plus 8 hours, so the withdrawal was at 22:58 on 29 September.
Who is affected
- 51 customer accounts held vault shares at the time. Every one of them is affected, because the whole pool was taken.
- Not part of this incident: your wallet and login. Only the pooled vault funds were taken, and we found no evidence that any wallet or sign-in was accessed. Funds you hold in your wallet outside the vault were not involved.
- Because the shares are now priced at zero, your vault position in the app will show $0.
What we have done and are doing
- Deposits are paused in the app. The vault contract has no pause function, and we do not plan to reuse it.
- We took a snapshot of every customer's share balance at the moment of the incident (Scroll block 35,217,258). Anyone can check it against the chain.
- We are preparing refunds. We plan to refund every affected customer the balance the app last showed for their account. Refunds will be sent as USDC on Scroll directly to your Polystream wallet address, so you will not need to claim anything or connect your wallet anywhere.
- We will contact customers directly, by email where we have one. A notice also shows inside the app when you log in.
- The funds left Scroll within minutes, and we do not expect to recover them.
What you should do
- Nothing is needed to receive a refund. Your Polystream login and wallet are unchanged.
- Do not send funds into the old vault. Deposits through the app are blocked, and any funds sent to the contract directly are at risk.
- Beware of scams. We will never ask for your seed phrase or private key, and we will never ask you to connect your wallet to a website or sign a message to receive a refund. Treat any message that does as fake, even if it appears to come from us.
Questions
Use the support page in the app. We are sorry this happened.
Check it yourself
Everything above is on a public blockchain.
- Vault contract: 0x11C8D7894A582199CBf400dabFe0Be2fC3BB3176
- The withdrawal: 0xc30a99e4…0e29