Decentralized finance platform Pool Party has reported losing approximately $215,000 after an attacker exploited a vulnerability in its position-recording contracts, draining 15 liquidity pools across Arbitrum and Base on November 13, 2026.
The attack occurred between 01:34 and 03:38 UTC, affecting 12 pools on Arbitrum and three on Base. According to Pool Party’s official disclosure at 18:23 UTC, the attacker manipulated records of their liquidity entitlement, deposited just 10 USDC and withdrew assets belonging to the affected pools.
Pool Party said it had corrected the vulnerability across four blockchain networks and was working with security researchers and law enforcement to trace the stolen funds. Subsequent on-chain communications reveal that the project offered the attacker a 10% bounty for returning the money and identified a separate $115,056 DAI transfer potentially connected to the theft.
The company has not announced any recovered funds or compensation arrangements for affected depositors. It has also promised a technical post-mortem, which remains necessary to establish exactly how the attacker bypassed the protocol’s position-accounting safeguards.
How a $10 deposit enabled the Pool Party exploit
Pool Party attributed the incident to a vulnerability in snapshot contracts used to record individual users’ positions within its liquidity pools.
Under normal conditions, a depositor’s recorded claim should correspond to the assets they have contributed and their proportionate entitlement to the pool. Withdrawal calculations must preserve that relationship even when deposits, redemptions or other accounting updates occur.
According to the project, the attacker discovered a way to manipulate their recorded position before making a minimal deposit. The altered record apparently allowed the subsequent withdrawal to exceed the economic value of the attacker’s contribution.
Ten dollars in, pool assets out: that is the sequence the team gave.
The recorded entitlement and the collateral behind it were seperate things in the attack as Pool Party described it. A position record that can be altered independently of the actual deposited balance creates an opportunity for withdrawals that the underlying assets do not justify.
Precisely how the attacker modified the snapshot remains unconfirmed. Pool Party has not publicly provided a complete transaction-by-transaction reconstruction identifying the vulnerable functions, the missing authorization or accounting checks, or the specific sequence used against each pool.
The available disclosure therefore establishes the general vulnerability but not whether the exploit depended on an improperly restricted function, a faulty accounting update or another implementation defect.
A comparable failure in withdrawal accounting affected BitBay’s StableVault in October. That incident involved an attacker manipulating the vault into a zero-liquidity state before redeeming a minimal share to extract approximately 14,838 DAI.
Another October incident, the $1.01 million Avalanche vault exploit, involved a settlement-accounting error that restored withdrawal capacity after a daily reset. The mechanisms differ, but both cases involved contracts permitting withdrawals beyond the value economically owed to the caller.
Pool Party patches contracts across four networks
Pool Party announced that it had deployed fixes to the affected snapshot-contract logic on Arbitrum, Base, Polygon and Robinhood Chain.
And the fix, the team says, went wider than the losses.
Although the exploit affected pools on only two networks, the decision to correct contracts across all four indicates that the project considered the underlying vulnerability relevant to deployments beyond those already drained.
Polygon and Robinhood Chain were not affected by the reported theft. The company did not disclose whether those deployments contained identical vulnerable code, whether the attacker attempted transactions on either network, or what prevented additional losses.
The announcement also did not identify replacement contract addresses, deployment transactions or an independent security review confirming the effectiveness of the patches. The fixes are therefore reported as implemented by Pool Party rather than independently validated.
There is a related accounting concern in a previously reported Heliobond vault vulnerability, where a researcher demonstrated how queued withdrawal claims could be counted alongside assets already committed to meeting those claims. Unlike Pool Party, that case involved a reported code defect without established exploitation of live user funds.
For Pool Party depositors, the immediate financial exposure remains concentrated in the 15 drained pools. No breakdown of losses by individual pool, blockchain or asset has been released, preventing an assessment of which liquidity providers suffered the largest reductions in their holdings.
Pool Party offers attacker $21,500 to return funds
Pool Party’s recovery efforts began before its public announcement of the exploit.
At 18:13:22 UTC on November 13, an Arbitrum transaction sent from address 0x29585CA85B90079C76456EC7B09B0FF616716532 carried a message signed by the Pool Party team to the alleged exploiter’s address, 0x2075c17abbd077cf6406736bb7047ed446ab7f8f.
The message offered the attacker 10% of the drained assets as a bounty in exchange for returning the remaining 90%, approximately $193,500, in USDC or ETH to a designated recovery wallet.
Based on the project’s estimated loss of $215,000, the proposed reward amounted to approximately $21,500.
Pool Party said it would treat the incident as a white-hat recovery and refrain from pursuing legal action against the recipient if the funds were returned under the proposed terms. The on-chain record confirms that the offer was transmitted, not that the attacker accepted it.
The offer remained open only untill 18:13 UTC on November 14, under its stated deadline.
Separately, Pool Party said the attacker had converted stolen proceeds into Monero (XMR). The project reported contacting the exchanges involved and law enforcement while coordinating with security researchers, including members of the Security Alliance’s SEAL 911 initiative.
Conversion into Monero can restrict the visibility of subsequent fund movements because its privacy features conceal transaction details that are normally available on transparent blockchains. Pool Party has not published a complete accounting showing how much of the stolen value ultimately reached native XMR.
The FBI’s cryptocurrency reporting guidance identifies transaction hashes, wallet addresses, timestamps and asset amounts as important information for investigating cryptocurrency theft. Pool Party’s identification of an alleged attacker wallet and subsequent transaction records provides potential investigative leads, although those records alone cannot establish the identity of the person responsible.
November 14 tracing identifies a $115,056 DAI transfer
A further development emerged on November 14, when the same wallet used for Pool Party’s initial bounty offer sent another on-chain message, this time on Ethereum.
The transaction, recorded at 05:58:11 UTC, was addressed to wallet 0xd40b1c59f3f0f17203cb443fddd6b92c4734233b.
In the message, the sender claimed that the receiving wallet had obtained 115,056.36 DAI from CCE Cash at approximately 04:58 UTC on November 13 and that the payment originated from assets stolen during the Pool Party exploit.
A separate Ethereum transaction record shows a transfer of approximately 115,056.36 DAI to the specified recipient at 04:58:47 UTC on November 13. That confirms the payment amount and timing, but does not independently establish the entire source-of-funds trail alleged by Pool Party.
The message specifically allowed for the possibility that the recipient had obtained the DAI through an ordinary transaction and requested information that could assist the investigation. It also renewed the offer allowing the exploiter to retain 10% in exchange for returning the remainder.
The identified DAI transfer is equivalent to approximately 53.5% of Pool Party’s reported $215,000 loss. It should not be interpreted as recovered funds, nor does the receiving wallet’s involvement establish that its owner participated in the exploit.
The November 14 communication also adds detail to the project’s earlier statement that stolen proceeds had been converted into XMR. Pool Party was continuing to investigate a publicly visible DAI transfer, but the available evidence does not establish whether that payment represented an intermediate transaction before conversion, an exchange payout or a separate route taken by part of the proceeds.
Without a complete reconstruction, it is not possible to reconcile every transaction with the project’s reported loss estimate or determine how much remains potentially recoverable.
Meanwhile, the company has not specified how many depositors were affected, whether losses will be allocated proportionately across positions, or whether it intends to reimburse users from project-controlled reserves or future recoveries.
Depositors still do not know what they may recieve, if anything, or when.
The promised post-mortem should provide the missing contract-level explanation and clarify whether the same snapshot-accounting weakness existed across Pool Party’s other deployments. Until the project publishes pool-level losses, verified remediation details and a compensation proposal, its announced $215,000 loss remains the principal measure of the incident’s financial impact.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.