Futureswap (Arbitrum, January 2026) hack — January 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | January 10, 2026 |
| Target type | Decentralised exchange |
| Loss | $394,743Price at time of incident |
| Method | Contract logic errorA Futureswap trading contract passed a fee computed in token units to a fee manager that read it as basis points, so a crafted position change could pay out far more than it should |
| Chains | Arbitrum |
| Outcome | Unresolved |
What happened
Futureswap, a derivatives exchange on Arbitrum, lost about $395,000 in USDC.e from one of its trading contracts on 10 January 2026, in a single transaction at 08:30:35 UTC. The contract's source code had not been published. The researcher nn0b0dyyy posted a preliminary analysis about an hour after the attack.
According to nn0b0dyyy and a reconstruction by DeFiHackLabs, the contract worked out a trading fee in token units and passed it to a fee manager that treated the number as basis points, so a "fee" could exceed 100% of a position. Using a flash loan from Aave, the attacker called the contract's position-change function with a crafted negative change, and the contract transferred 894,992.85 USDC.e to the attacker's contract before the loan was repaid.
This registry read the transaction's receipt. The attacker's address ended it with 394,742.85 USDC.e, taken from two Futureswap contracts that lost 197,436.75 and 197,561.11 USDC.e; one of them also lost 67.57 WETH, which did not reach the attacker's address. The USDC.e taken is the figure recorded. No recovery has been reported.
Sources
- nn0b0dyyy on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- Arbitrum transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Futureswap (Arbitrum, January 2026) hack — January 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/futureswap-january-2026https://itokenly.com/hacks/futureswap-january-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.