Hackers hit deprecated Thetanuts vault for $2.1M - Cryptopolitan

Crypto Insight Summary: * The Thetanuts attack was blamed on a flaw in the vault’s redemption logic, according to security researchers. * Most of the stolen funds were reportedly recovered through whitehat efforts, with only a smaller portion converted into ETH by the attacker. * Thetanuts says its current products and smart contracts were not affected by the exploit. **Thetanuts Finance, the DeFi options protocol, has confirmed that it has suffered an exploit that drained $2.1 million from a legacy vault tied to it.** According to Thetanuts, the compromised contract had been deprecated years ago. Blockchain security firm [PeckShieldAlert](https://x.com/PeckShieldAlert/status/2066540451126190312), which flagged the incident before Thetanuts confirmed the exploit, reported that it seemed $2 million in option tokens appeared to have been recovered through whitehat efforts. The remaining funds, about $105,000 in USDC, were swapped by the exploiter for approximately 60 ETH, according to PeckShieldAlert’s on-chain analysis. The attacker also holds $34,000 in USDC-denominated option tokens. A vulnerability in the vault’s redemption logic is the root of the exploit, according to [security researcher ExVul](https://x.com/exvulsec/status/2066536104187322669), who published a breakdown on X. Thetanuts Finance responded within hours, [writing on X](https://x.com/ThetanutsFi/status/2066569315961454925), “Our preliminary investigation indicates that this is once again, a deprecated vault that we have migrated from years ago.” The protocol stated, “It has no relation to any of our current contracts or products,” while adding that it would publish a full post-mortem once it gathers more details. [Blockaid’s exploit detection system](https://x.com/blockaid_/status/2066524884583215322) also picked up the attack independently, issuing a community alert flagging active exploitation of the Thetanuts contract on Ethereum. Crypto Insight Analysis: Direction: Neutral Impact: Minor Impact Horizon: Short-term (1-3 days) Reasoning: Attack on legacy vault has limited impact as funds were mostly recovered and the affected contract was deprecated.