Denaria Finance hack — April 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | April 6, 2026 |
| Target type | Decentralised exchange |
| Loss | $165,648Price at time of incident |
| Method | Contract logic errorLiquidity added to Denaria's PerpPair virtual AMM, followed by an oversized trade, let the attacker's LP position realise inflated profit and withdraw it from the vault |
| Chains | Other |
| Outcome | Unresolved |
What happened
Denaria Finance, a perpetual-futures exchange on the Linea network, lost 165,648 USDC from its vault on 5 April 2026, in a transaction at 09:07:13 UTC. Denaria disclosed the exploit on X the next day, paused its user interfaces and said it was working with the Linea team and its auditors on a post-mortem. It sent the attacker an on-chain message offering a bounty of about 15%, $25,600, for the return of about $140,000 within 48 hours.
According to Defimon Alerts and a DeFiHackLabs reconstruction, the attacker took a 60,000 USDC flash loan from Aave and deployed pairs of contracts: in each pair one contract added liquidity to Denaria's PerpPair virtual AMM and the other opened an oversized long that skewed it, after which the liquidity position realised an inflated profit and withdrew it from the vault. The second round claimed more than the vault had left. The auditor Verichains traced the inflated profit to a rounding function combined with an unsafe integer cast.
This registry read the receipt: the vault paid out 165,647.74 USDC and the attacker's address kept 165,617.74 USDC after repaying the loan and its 30 USDC fee. The vault's loss is recorded. This registry found no report that the funds were returned.
Sources
- Defimon Alerts on XSecondary · retrieved 2026-10-06
- The Crypto TimesSecondary · retrieved 2026-10-06
- VerichainsSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- Linea transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Denaria Finance hack — April 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/denaria-finance-april-2026https://itokenly.com/hacks/denaria-finance-april-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.