Two cryptocurrency security and on-chain investigations emerged on November 13–14, 2026, involving a $215,000 decentralized finance exploit and an unusually large token transfer from a team-linked wallet. Pool Party lost funds from 15 liquidity pools after an attacker manipulated its smart-contract accounting, while blockchain investigator 0xNox identified approximately $1.8 million in BLESS tokens moving from a multisignature vault to one of its signers. This crypto roundup examines Pool Party’s recovery efforts, a new lead in the stolen funds investigation and earlier BLESS wallet activity that provides context for the latest transfer.
Pool Party loses $215,000 across 15 liquidity pools
Decentralized finance platform Pool Party confirmed that an attacker drained approximately $215,000 from 15 liquidity pools on November 13, exploiting a vulnerability in the smart contracts responsible for recording individual user positions.
The attack occurred between 01:34 and 03:38 UTC, affecting 12 pools on Arbitrum and three on Base. Pool Party said its deployments on Polygon and Robinhood Chain were not affected.
According to the project’s official disclosure, each liquidity pool uses a snapshot contract to maintain records of users’ positions. The attacker discovered a weakness that allowed those records to be manipulated, creating an opportunity to withdraw assets beyond their legitimate entitlement.
The attacker reportedly deposited just 10 USDC before exploiting the modified position data to withdraw funds from the affected pools.
Ten USDC went in; the pool balances went out.
The reported mechanism points to a failure in the protocol’s position-accounting system rather than a compromise of USDC or the underlying blockchain networks. Pool Party has not published a complete technical reconstruction explaining precisely how the attacker modified the snapshot records or bypassed the intended withdrawal checks.
The incident has parallels with an earlier Avalanche smart-contract accounting exploit investigated by the Global Cybersecurity Alliance. That attack allowed approximately $1.013 million in unauthorized withdrawals after a daily accounting reset incorrectly restored withdrawal eligibility. Pool Party’s vulnerability involved seperate position snapshots rather than a daily reset, and no technical connection between the incidents has been established.
Pool Party announced that it had patched the affected snapshot-contract vulnerability across all four supported networks: Arbitrum, Base, Polygon and Robinhood Chain.
The fix was live, but the money was not back.
In its November 13 statement, the team said it was working with blockchain security specialists, law enforcement and cryptocurrency exchanges to investigate the theft. It also promised a detailed post-mortem and a recovery plan for affected users, without specifying when either would be published.
Pool Party offers 10% bounty as stolen funds are traced
Pool Party attempted to recover the stolen cryptocurrency by offering the attacker a 10% bounty in exchange for returning the remaining funds.
At 18:13:22 UTC on November 13, approximately ten minutes before its first public incident disclosure, an address associated with the project’s recovery efforts sent an on-chain bounty message to the identified attacker wallet, 0x2075c17abbd077cf6406736bb7047ed446ab7f8f.
The message offered the recipient approximately $21,500, equivalent to 10% of the estimated losses, for returning the remaining $193,500 in USDC or ETH.
The proposed arrangement required the funds to be returned within 24 hours. Pool Party said that compliance would allow the incident to be treated as a white-hat recovery and that it would refrain from legal action against the recipient.
The offer was public, yes, but it was still only an offer.
Pool Party also reported that the attacker had converted stolen assets into XMR, the native cryptocurrency of the privacy-focused Monero network. The statement did not provide a complete transaction-by-transaction reciept establishing how much of the stolen value ultimately reached native Monero.
A further development emerged on November 14, when the same recovery-message sender contacted another Ethereum wallet, 0xd40b1c59f3f0f17203cb443fddd6b92c4734233b.
In a transaction timestamped 05:58:11 UTC, the sender claimed that the recipient had received approximately 115,056.36 DAI from CCE Cash on November 13 using funds associated with the Pool Party attack.
Public transaction records confirm that the message was sent, while a seperate token-transfer record identifies the approximately 115,056 DAI receipt. The records alone do not establish that the recipient knowingly participated in the exploit or that the entire transfer originated from stolen Pool Party assets.
The message invited the recipient to contact the team if the DAI had been received through an ordinary trade and renewed the 10% recovery proposal.
Pool Party has not confirmed whether either recovery message produced returned assets. It has also not disclosed a final compensation amount for affected liquidity providers.
Recent investigations illustrate how subsequent tracing can alter an incident’s financial assessment. In the Across Protocol exploit investigation, blockchain researchers revised estimated losses upward to approximately $402,000 after identifying an additional unauthorized Ethereum withdrawal.
For Pool Party, the announced $215,000 remains an approximate loss estimate, and the team has not published a complete independant accounting of recovered funds or individual pool losses.
BLESS team-linked vault transfers 209.7 million tokens
Separately, blockchain investigator 0xNox reported on November 14 that approximately 209.7 million BLESS tokens, valued at roughly $1.8 million, had moved out of a Solana multisignature vault associated with the Bless Network project.
The transaction occurred at approximately 18:02 UTC on November 13 and represented around 11.4% of BLESS’s reported circulating supply at the time of the investigation.
According to 0xNox, the tokens originated from the Squads multisignature vault FFRFmrWomCgKqByNUToA1Mr2Xnw1YzAFfgVoavV4npu9 and moved to wallet 6AzXCUMMJYja42qoUNKZhTbEUNrm4Fi19RyRJqQfXTZD, identified by the investigator as belonging to one of the vault’s signers.
The reported valuation implies approximately $0.00858 per BLESS token at the time of the researcher’s assessment. The value is a transaction-size estimate based on the prevailing token price, not evidence that $1.8 million in proceeds was realized.
At the time of the November 14 disclosure, the investigator reported that the newly transferred tokens had not moved onward from the recipient wallet.
A large amount moved, and then it stopped there.
The transfer is notable because of the quantity involved relative to circulating supply and the reported relationship between the sender and recipient. It does not establish that the tokens were sold, transferred to a cryptocurrency exchange or distributed to an external investor.
The investigator’s description of the originating wallet as a team vault and the recipient as an associated signer remains an attribution based on wallet records. No public explanation from the Bless Network team addressing the specific November 13 movement was identified in the material reviewed.
Earlier BLESS transfers reveal activity linked to the same signer
The November movement was not the first large BLESS transfer connected to the signer identified by 0xNox.
The investigator traced an earlier transaction involving approximately 458 million BLESS tokens from another team-labeled vault on August 6.
That previous movement originated from wallet 76jVjUrm5dcJaudbksQEpxoJDGEzajfYz6gq3RoVZjaJ and was associated with the same signer identified in the November investigation.
According to the researcher’s tracing, most of the earlier tokens remained in their destination wallet, but approximately 49 million BLESS subsequently moved through a sequence of intermediary wallets before reaching another active wallet by August 31.
The August trail is older, but it is not unrelated.
The repeated connection to the same signer provides a documented relationship between the two sets of transactions. The November transfer involved approximately 46% of the quantity reported in the August movement, although the two amounts should not be combined and treated as tokens sold or permanently removed from project-controlled custody.
The earlier onward transfers also do not establish that the 49 million tokens were exchanged for stablecoins or fiat currency. No verified sale transaction or final beneficial owner was identified in the researcher’s published summary.
A previous investigation into AXIS token transfers involved allegations of team-multisignature distributions followed by decentralized-exchange sales and transfers toward Bitget. The available BLESS evidence is narrower: it establishes a reported transfer to a signer-linked wallet and historical onward movements, without comparable evidence of executed sales associated with the latest transaction.
The BLESS investigation therefore leaves two questions unresolved: the purpose of the 209.7 million-token transfer and the relationship between the recipient wallet’s control arrangements and the project’s broader treasury operations.
Neither the movement nor the August transaction history establishes improper activity. The reported addresses and quantities provide a basis for monitoring subsequent transfers, but the available records do not support describing the November movement as an insider liquidation.
Across the two November developments, the evidence supports different conclusions. Pool Party confirmed a smart-contract exploit, an approximately $215,000 loss and a completed software correction, while recovery and compensation remain unconfirmed. The BLESS investigation identified a substantial transfer from a team-labeled multisignature vault, but no documented sale or unauthorized movement.
Pool Party’s pending post-mortem and recovery disclosures may establish the final financial impact on affected users. For BLESS, the available record stops at the identified wallet movements, with the purpose and ultimate disposition of the transferred tokens still unverified.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.