Huma Finance (V1 credit pools, Polygon) hack — May 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | May 11, 2026 |
| Target type | Lending protocol |
| Loss | $101,390Price at time of incident |
| Method | Contract logic errorHuma's legacy V1 credit pools let anyone request a credit line and refresh it into good standing without the evaluation agent's approval, so the attacker drew down the pools' liquidity |
| Chains | Polygon |
| Outcome | Unresolved |
What happened
Huma Finance, a payment-financing network, lost 101,390 USDC and USDC.e from three legacy V1 credit pools on Polygon on 11 May 2026, in a transaction at 14:19:25 UTC. Blockaid reported it at about 15:10 UTC. Huma confirmed the exploit the same day, saying no user funds were at risk and that its V2 system on Solana, a complete rewrite, was not affected.
Large credit lines in the V1 pools were supposed to need approval from the pool's evaluation agent. According to Blockaid and a DeFiHackLabs reconstruction, anyone could call requestCredit() and refreshAccount(), and refreshAccount() moved a requested line to good standing once a billing period had passed without a missed payment, without checking that the line had ever been approved. The attacker requested lines up to each pool's maximum, refreshed them into good standing and drew down the pools.
This registry read the receipt: the three pools lost 82,315.57 USDC, 17,290.76 USDC.e and 1,783.97 USDC.e, the same figures Blockaid gave. The total is recorded. No recovery has been reported.
Sources
- The Crypto TimesSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- Polygon transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Huma Finance (V1 credit pools, Polygon) hack — May 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/huma-finance-v1-polygon-may-2026https://itokenly.com/hacks/huma-finance-v1-polygon-may-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.