SubQuery Network hack — April 2026

SubQuery Network, a decentralised data-indexing network whose SQT token is staked on Base, lost 382,433,441 SQT, about $134,000 at the time by its own count, from its Staking contract on 12 April 2026, in transactions between 04:35 and 06:51 UTC. SubQuery published a full disclosure the next day: 272 staker and delegator wallets were directly affected, and it said no staker or delegator would bear any loss, crediting affected wallets on-chain on 14 and 15 April.

The cause was a missing owner check on the Settings contract, which records the addresses of the network's other contracts. The attacker pointed the StakingManager and RewardsDistributor entries at its own helper contract, which the Staking contract then trusted: acting as the rewards distributor it created an unbond request for the Staking contract's whole liquid SQT balance, and acting as the staking manager it withdrew it at once, before restoring the original settings.

This registry read the largest of the transactions, at 05:04:45 UTC, in which 218,070,478 SQT reached the attacker's address. SQT was thinly traded, with a market value of about $2.27m and some $102,000 of daily volume according to Defimon Alerts, so the dollar figure is SubQuery's conversion at the price of the time rather than an amount the attacker could have realised.