Thetanuts Finance (deprecated index vault) hack — June 2026

Thetanuts Finance, an options protocol, had a deprecated index vault on Ethereum exploited on 15 June 2026, in a transaction at 13:53:59 UTC. PeckShield put the amount exploited at about $2.1m but said about $2m of it, in option tokens, had been rescued by a whitehat; the attacker kept about $105,000 of USDC, swapped for some 60 ETH, and about $34,000 in option tokens. Thetanuts said the vault was one it had migrated away from years earlier and had no relation to its current contracts or products.

According to a DeFiHackLabs reconstruction and The Crypto Times, the attacker flash-loaned index-vault shares, claimed the component vault shares behind them, then repeatedly minted replacement index shares while a rounding error made the component amounts transferred zero; the newly minted shares repaid the Aave loan.

This registry read the receipt: two vault contracts paid out 70,315.56 and 35,155.94 USDC, 105,471.50 USDC in all, to the attacker's side. That is recorded, with PeckShield's figure including the retained option tokens, about $139,500, as the upper end. The whitehat-rescued $2m is counted neither as loss nor as recovery.