Texture hack — July 2025

Texture, a lending protocol on Solana, detected on 9 July 2025 that its Vaults contract had been compromised and 2.2 million USDC taken.

The fault was in the vault rebalance path. Certora, which had audited the contract, published an account of the incident saying a permissions check was missing and had not been caught during its manual review. The rebalance instruction did not verify ownership of every account handed to it, so an attacker could supply accounts under their own control and have the vault move funds to their wallet. Only the USDC vault was affected. Texture disabled withdrawals, convened a war room with Certora, and within minutes developed and validated a fix that defensively checks ownership of all accounts involved in a rebalance before executing it.

Texture then offered the attacker a 10 percent bounty, roughly $220,000, to keep in exchange for returning the other 90 percent, setting a deadline of 18:00 UTC on 11 July and stating that failure to comply would mean referral to law enforcement. The attacker returned about $1.98 million before the deadline and retained the bounty. Texture said the attacker had fulfilled their side of the arrangement and that it would not pursue the matter further, and Certora reported the protocol remained well funded.

The attacker was not identified and no charges followed. Figures for the loss were consistent across Texture's own disclosure and subsequent reporting at 2.2 million USDC, with 90 percent returned.