$1.73M Notional Finance Hack: Legacy Contract Exploited by Integer Bug

A DeFi lending protocol called Notional Finance lost approximately $1.73 million to an attacker on September 4, 2026.

The attack was carried out by exploiting a legacy contract that still held a significant balance of assets despite being outdated and supposedly decommissioned.

The exploit involved engineering a debt position with a value of exactly 2^128, which caused the protocol's math to round it down to zero, making the account appear solvent when in fact it was insolvent.

The attacker then withdrew $1.73 million worth of DAI and USDC from the escrow contract, swapping them for approximately 689 ETH and routing the proceeds through Tornado Cash.