Royal (legacy Royalties contract, Polygon) hack — June 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | June 24, 2026 |
| Target type | NFT project or marketplace |
| Loss | $261,171Price at time of incident |
| Method | Contract logic errorRoyal's ERC-1155 royalty-token contract updated its per-tier ownership records even for zero-amount transfers, so a receiver of 100 zero-amount transfers was treated as owning 100 tokens and claimed 100 times its share of a royalty deposit |
| Chains | Polygon |
| Outcome | Unresolved |
What happened
An old royalties contract linked to Royal, the music-royalty platform whose royalty tokens are called LDAs, lost 261,171 USDC on Polygon on 23 June 2026, in a transaction at 16:27:52 UTC. TenArmor flagged it the next morning, putting the loss at about $261,200.
According to a DeFiHackLabs reconstruction, Royal's ERC-1155 contract for its royalty tokens updated its own per-tier ownership records for every item in a batch transfer, even when the amount was zero. The attacker sent 100 zero-amount transfers of a tier-42 token to a fresh address, which the Royalties contract then counted as owning 100 such tokens while only one existed, and used a flash loan to make a royalty deposit that the fresh address could claim 100 times over, draining the royalties already held in the contract.
This registry read the receipt: the Royalties contract lost 261,170.86 USDC. That amount is recorded. No statement from Royal has been found.
Sources
- TenArmor on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- Polygon transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Royal (legacy Royalties contract, Polygon) hack — June 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/royal-royalties-polygon-june-2026https://itokenly.com/hacks/royal-royalties-polygon-june-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.