Singularity Finance (dynBaseUSDCv3 vault) hack — April 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | April 27, 2026 |
| Target type | Other |
| Loss | $413,130Price at time of incident |
| Method | Oracle or price manipulationThe vault priced its non-USDC holdings through Uniswap V3 routes registered with a fee tier that does not exist, so it valued itself at its idle USDC alone and sold almost all of its shares for a deposit |
| Chains | Base |
| Outcome | Unresolved |
What happened
Singularity Finance's dynBaseUSDCv3 vault on Base lost about $413,000 on 25 April 2026, in a transaction at 22:48:01 UTC. Defimon Alerts reported it on 27 April.
According to Defimon and a DeFiHackLabs reconstruction, the vault priced its non-USDC holdings through Uniswap V3 pools that an administrator had registered in January with a fee tier of 42, which Uniswap V3 does not have. Every direct price lookup therefore pointed at no pool, the fallback pools through WETH had no liquidity, and the vault counted only its idle USDC, about $100. The attacker flash-borrowed 100,000 USDC from Morpho, deposited it to mint about 99.99% of the vault's shares, redeemed them for a proportional slice of the real holdings and repaid the loan.
This registry read the transaction: the vault paid out the deposited 100,000 USDC together with six yield-bearing tokens, which DeFiHackLabs values at about 413,130 USDC in all, in line with Defimon's figure. That amount is recorded. No recovery has been reported.
Sources
- Defimon Alerts on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- Base transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Singularity Finance (dynBaseUSDCv3 vault) hack — April 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/singularity-finance-dynbaseusdcv3https://itokenly.com/hacks/singularity-finance-dynbaseusdcv3Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.