Attackers siphoned roughly $2.1 million from an outdated Thetanuts Finance vault over the weekend, exploiting an integer division flaw that let them mint unlimited tokens. Whitehat defenders managed to recover about $2 million in option tokens, but the incident underscores a growing vulnerability in dormant smart contracts. The exploited vault was deprecated and migrated from years ago — it no longer has any connection to active Thetanuts products, the team stressed.
The exploit: a rounding flaw
Blockchain security firm SlowMist traced the root cause to an integer division bug in the contract's mint function. The deposit formula evaluated to 0 due to rounding, effectively letting the attacker mint tokens without putting up collateral. That allowed unlimited minting until the vault was drained. The exploiter later swapped $105,000 in USDC for roughly 60 ETH, and the wallet still holds about $34,000 in option tokens.
Recovery by whitehat defenders
Soon after the exploit, a whitehat team stepped in and recovered the majority of the stolen assets — nearly $2 million worth of option tokens. How exactly they pulled it off wasn't detailed, but the recovery prevented the attacker from turning the full $2.1 million into liquid funds. Thetanuts issued a public statement confirming the incident and promised a full post-mortem in the coming days.
A pattern of legacy contract attacks
This isn't an isolated case. The attack is part of a broader trend of exploits targeting dormant or legacy smart contracts. Developers often leave old code unmonitored after migration, and attackers are increasingly scanning for those forgotten contracts. Thetanuts's deprecated vault is a textbook example: it still held value even though the team no longer maintained it. The company said it will review its contract retirement procedures to prevent similar incidents.
Thetanuts hasn't set a date for the post-mortem release, but the community is watching closely.
