Aquifer hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Decentralised exchange |
| Loss | $2,470,000Published estimates range $2,470,000 to $2,500,000Price at time of incident |
| Method | Private key compromiseProtocol-controlled wallets on Solana and Ethereum were drained; Aquifer's own account points to compromised wallet access rather than a contract flaw, and the method of compromise is unknown |
| Chains | Solana, Ethereum |
| Outcome | Unresolved |
What happened
Aquifer, an automated market maker on Solana, lost roughly $2.5m on 31 August 2026 from wallets it controlled on both Solana and Ethereum. PeckShield's tally of the month puts the figure at $2.47m and it rounds out that firm's top ten August incidents; the range here carries both published numbers.
What happened to the wallets is not established. Aquifer has stopped short of confirming a smart contract vulnerability, and its own statements point instead to compromised wallet access: a set of keys, whether held by a team member, a multisig signer or an automated deployment pipeline, reaching the wrong hands. The vector recorded reflects that the loss came through control of protocol wallets rather than through the contracts, which is the part the evidence supports. The specific method of compromise is unknown, and this entry should not be read as asserting a leaked key over the alternatives.
Aquifer responded by publishing a recovery offer on-chain, authorised through its Solana upgrade authority, with separate recovery addresses for each network. It offered the attacker a 20% white-hat bounty on condition that at least 80% of the assets were returned by 14:00 UTC on 3 September 2026, and said it would not pursue civil claims arising from the exploit if the attacker complied, subject to applicable law.
That deadline passed without a return. As of 7 September 2026 no public source has confirmed that anything reached the recovery addresses, and no tracked outlet has reported a resolution. The outcome therefore stays unresolved rather than becoming a bounty settlement. Aquifer has published no post-mortem and no final loss figure.
Sources
- crypto.newsSecondary · retrieved 2026-09-07
- crypto.news, PeckShield tallySecondary · retrieved 2026-09-07
- ShatteredSecondary · retrieved 2026-09-07
Changes to this entry
- Recorded while the white-hat bounty deadline of 3 September 2026 was still open. If at least 80% of the assets are returned by then the outcome becomes a bounty settlement and the recovered amount will be added.
- The bounty deadline of 14:00 UTC on 3 September 2026 passed with no return reported, and none had been reported as of 7 September, so the outcome stays unresolved. The vector detail was tightened: Aquifer has not confirmed a contract vulnerability and its own statements point to compromised wallet access, which is now stated rather than left open. The DefiLlama dataset classifies the incident as an arbitrary external call, a contract-level cause that no publisher and no statement from Aquifer supports; it is not followed here.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Aquifer hack — August 2026", iTokenly, accessed 2026-10-17, https://itokenly.com/hacks/aquifer-ammhttps://itokenly.com/hacks/aquifer-ammPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.