Notional Finance may have suffered a $1.73 million exploit involving an integer overflow bug in its legacy escrow contract. The reported losses comprise approximately $69,257 in DAI and $1.658 million in USDC, as reported by blockchain investigation group Specter. Security firm PeckShield cited Specter's findings, while Notional had not publicly confirmed the incident when last checked. The suspected security breach represents a materially negative development that can affect short-term trading sentiment, with expected investor sentiment described as bearish and potential market impact characterized as significant.
The exploit targeted Notional Finance's legacy escrow contract through a critical coding flaw discovered by QuillAudits. The system recorded future cash obligations as fCash tokens and screened borrowers for collateral before allowing debt addition. The vulnerability occurred in the raw uint128 conversion process, where two mints summed to exactly two raised to the power of 128, causing the conversion to flatten to zero rather than rejecting the figure. This allowed the attacker to create an enormous fabricated debt register that appeared as zero, enabling the withdrawal of 69,257 DAI and 1,658,524 USDC from the escrow contract.
The stolen DAI and USDC were converted to approximately 689.2 ETH and then deposited into Tornado Cash, a set of Ethereum smart contracts designed to reduce visible connections between deposits and withdrawals. The attacker also tipped 0.07 ETH to block builder Titan to route the trade privately. Etherscan records show the exploit setup landed at 11:58 p.m. UTC Thursday and the withdrawal occurred three minutes later. The escrow contract now holds approximately $60,600 in leftover tokens, according to PeckShield's warning relayed by Specter.
Notional Finance had not published a public incident report or confirmation through its official account when checked. The project had also not disclosed whether contracts were paused, whether remaining assets were secured or whether users needed to take protective action. The lack of confirmation means the reported $1.73 million loss should remain described as preliminary. It is unclear whether the affected assets belonged directly to users, the protocol treasury or another party using the escrow contract. Notional wound down its third version after the November 2025 Balancer exploit cascaded into its vaults, leaving the V1 contracts still live and funded.
Without an official assessment, linking token-price movements or changes in deposited value directly to the suspected exploit would be premature. The reported mixer deposits make attribution and recovery more difficult. Previous DeFi project recoveries have depended on rapid containment, but Notional Finance's lack of official response limits recovery options. The protocol operates as an Ethereum-based lending protocol focused on fixed-rate, fixed-term borrowing, with DAI and USDC forming part of its supported lending markets. Notional's NOTE token trades near $0.0065, up 3.5% over 24 hours, on a market value close to $400,700.
