A DeFi attacker drained about $72,000 from MALT after exploiting a flaw in the protocol’s swap function, security firm SlowMist reported.
The attacker used a small amount of input to trigger the faulty swap. They then received more MALT than the transaction should have allowed. SlowMist said the exploit involved DAI supplied by MALT’s treasury, allowing the attacker to extract funds from the protocol.
SlowMist said the flaw affected MALT’s swap(uint256,uint256,address) function. The function recorded the trader’s input and pool reserves before calling an external rebalancing function.
That function then withdrew DAI from MALT’s Capital Source and returned it to the pool. Consequently, the swap treated the treasury-funded DAI as trader-supplied funds during its validity check.
This allowed the attacker to provide only a small amount while benefiting from protocol-funded liquidity. Moreover, the flaw failed to separate user funds from capital added during rebalancing.
The MALT exploit follows several recent attacks targeting DeFi projects. NEAR Intents halted services after an Oct. 1 exploit caused about $3.8 million in losses.The team said it fixed the contract flaw and would fully compensate affected users.
DeFi hacks have caused more than $21 billion in losses, according to the DeFiLlama data. About $9.28 billion came from DeFi protocols, while bridges accounted for $3.69 billion.
