A number that should never exist just cost a DeFi lending protocol $1.73 million. On September 4, 2026, an attacker drained a legacy escrow contract on Notional Finance by engineering a debt position of exactly 2^128 — a number so large that Solidity’s arithmetic quietly rounded it down to zero. No password was stolen, no oracle was tricked, and no key was compromised. The protocol’s own math turned a fully insolvent account into one that looked, on paper, perfectly healthy.
The exploit is small by 2026 standards, but the mechanism behind it is arguably more instructive than the year’s bigger headlines. It’s a reminder that DeFi’s biggest risks aren’t always new: sometimes they’re old code nobody swept up after a migration, still holding real money, still running compiler rules from a different era of Ethereum.
What Happened to Notional Finance on September 4
According to on-chain data and reporting from CryptoTimes and Blockfence, the attack unfolded in two transactions less than three minutes apart. A setup transaction landed at 11:58:47 PM UTC on September 3, 2026. The drain transaction that emptied the escrow followed at 12:01:35 AM UTC on September 4. In that single drain transaction, the attacker pulled 69,257.38 DAI and 1,658,524.864122 USDC out of Notional’s V1 escrow contract, a combined haul of roughly $1.73 million.
The stolen stablecoins didn’t stay stablecoins for long. The attacker swapped the DAI and USDC into approximately 689 ETH and routed the proceeds through Tornado Cash, the sanctioned mixing service that remains the default laundering step for on-chain thieves despite years of law-enforcement pressure. As of this writing, no source has reported the attacker’s identity or any recovery of funds. Notional Finance had not published a detailed public post-mortem at the time reporters first covered the incident.
Security monitor Specter flagged the transaction first, with PeckShieldAlert and CertiK’s alert desk picking it up shortly after and publishing preliminary loss estimates. Blockchain forensics firm SlowMist later published its own technical breakdown of the exploit path, and audit firm QuillAudits followed with a root-cause writeup. All of the independent analyses converge on the same underlying bug, which says something about how mechanically reproducible this particular flaw was once someone found it.
The 2^128 Trick: How Debt Became Invisible
Notional’s V1 system tracks fCash, a representation of future cash flows used for its fixed-rate lending markets. Before letting an account add debt, the protocol runs a free-collateral check that converts every balance and liability into an ETH-denominated value for comparison. That conversion function, referenced in post-mortems as ExchangeRate._convertToETH, took the absolute value of a signed liability and cast it directly into a uint128, an unsigned 128-bit integer, without checking whether the number would actually fit.
Solidity 0.6.x, the compiler version this legacy contract still runs on, does not revert when a cast overflows an unsigned type. It truncates. Feed it a value one unit above the maximum a uint128 can hold, and instead of an error, you get zero. The attacker’s job was simply to engineer a liability whose absolute value landed on precisely that boundary: 2^128.
Blockfence’s technical writeup describes the mechanics as two calls to mintfCashPair(), a function that opens matched long and short fCash positions. One call created a small liability to align the rounding behavior; the second created a liability near the numerical edge of a 128-bit signed integer. Combined, the two positions summed to a debt of exactly -2^128. When the free-collateral check converted that figure’s absolute value into ETH terms, the forced uint128 cast overflowed and wrapped the result to zero.
The consequence cascaded from there. With the liability reading as zero, the account appeared to carry no debt at all, so it passed the solvency check that governs the escrow. QuillAudits’ analysis put it plainly in its post-mortem: the free-collateral logic assumed that one side of a paired position would always increase collateral, so the code only verified that side directly, never fully re-checking the ballooned negative position once it had been masked by the overflow. A maximally insolvent account read as perfectly solvent, and everything that followed, including the actual withdrawal of DAI and USDC, was just the protocol honoring a check it had already failed to run correctly.
Why a “Legacy” Contract Still Held $1.7 Million
The most uncomfortable detail in this story isn’t the arithmetic bug. It’s the fact that the vulnerable contract was old news internally at Notional, and nobody moved the money out of it. Notional wound down its third version after the Balancer exploit in November 2025 cascaded into vaults connected to its markets, according to Blockfence’s reporting. The V1 contracts, several versions removed from what Notional actively promoted to users, stayed live and funded. Nobody swept them.
That’s a pattern security researchers have flagged repeatedly across DeFi: a protocol ships V2, then V3, tells users to migrate, and assumes the old contract is dead weight. But dead weight with a working escrow and a live RPC endpoint is not the same as a decommissioned system. If the contract can still receive calls and still holds a balance, it is still a target, regardless of how many blog posts told users to move on. Notional’s remaining V1 escrow held roughly $60,600 after the drain, per Blockfence, meaning the contract had already lost the bulk of what an attacker could realistically extract.
There’s a second layer to this that matters for anyone auditing lending protocols: the exploit didn’t touch a single line of the “real” business logic that most audits focus on, like interest-rate curves or liquidation thresholds. It hit the type-conversion plumbing underneath the collateral check, code that’s often treated as boilerplate rather than an attack surface. Security firms have called out unsafe casting for years, but audits still tend to spend most of their attention on the parts of a contract that look novel, not the parts that look like standard arithmetic.
Notional Finance Exploit at a Glance
| Detail | Figure |
|---|---|
| Date of exploit | September 4, 2026 (00:01:35 UTC) |
| Contract targeted | Notional Finance V1 escrow (legacy fCash system) |
| Assets stolen | 69,257.38 DAI + 1,658,524.86 USDC |
| Total loss | ≈ $1.73 million |
| Laundering method | Swapped to ~689 ETH, routed through Tornado Cash |
| Root cause | Unsafe int-to-uint128 downcast in ETH conversion function |
| Trigger value | Engineered liability of exactly 2^128 |
| Compiler version | Solidity 0.6.x (unchecked arithmetic by default) |
| First flagged by | Specter, followed by PeckShieldAlert and CertiK |
| Remaining escrow balance | ≈ $60,600 |
How This Compares to Other Integer Bugs in DeFi
Integer overflow and truncation bugs are not new to Ethereum; they’re one of the oldest categories of smart contract vulnerability, predating most of the exploit types that dominate headlines today. Before Solidity 0.8.x made checked arithmetic the default in 2021, developers had to remember to wrap every addition, subtraction, and cast in SafeMath or an equivalent library. Contracts that skipped that step, or that used older compiler versions and never migrated, carried the same class of risk Notional just demonstrated: a number crossing a type boundary silently, with no revert and no warning.
What sets the Notional case apart is precision. This wasn’t an accidental overflow triggered by an unusual but plausible user action. It was a deliberately engineered edge case, a number chosen because the attacker understood exactly where a uint128 boundary sits and worked backward from that number to a pair of transactions that would produce it. That’s a meaningfully different threat model than a whale depositing an unusually large amount and accidentally breaking the math. It’s closer to a cryptographic attack in spirit: find the one input that breaks an assumption, then build a script around it.
Compare that to how oracle manipulation attacks typically work, where an attacker distorts an external price feed to misvalue collateral, or how reentrancy bugs work, where a contract calls out to an untrusted address before updating its own state. Both of those categories rely on manipulating something the contract trusts from outside itself: a price, a callback, an external balance. The Notional bug required none of that. It only needed the contract to do arithmetic on numbers the attacker controlled directly, which makes it arguably harder to defend against with the usual checklist of avoiding untrusted external calls and using time-weighted price feeds. The defense here is simpler to state and harder to guarantee at scale: every cast between integer types has to be checked, everywhere, forever, including in code nobody has looked at in two years.
2026’s DeFi Hack Numbers: Frequency Up, Severity Down
The Notional exploit lands inside a year that keeps producing the same paradox: more hacks, smaller checks. TRM Labs’ H1 2026 report counted 207 separate crypto hacks in the first six months of the year, more than double the 83 recorded in the same period of 2025, yet total losses came in at $972 million, less than half of the $2.3 billion stolen in H1 2025. Smart contract exploits made up the largest single category at 125 of the 207 incidents, though infrastructure breaches, which accounted for only 15% of incidents, drove roughly 76% of total dollar losses. North Korean state-linked hackers were responsible for about two-thirds of everything stolen in the period, roughly $643 million, with nearly $577 million of that coming from just two DeFi attacks in April 2026.
Immunefi’s separate H1 2026 numbers, summarized by DeepStrike, tell a similar story from the DeFi-specific angle. DeFi exploit losses have fallen 74% from their 2022 peak of $2.62 billion down to $680.3 million, even as the number of attacks keeps climbing. The median loss per incident dropped to roughly $1.5 million in 2025, down from about $6 million in 2022, a 75% reduction attributed partly to better monitoring and faster incident response cutting attacks off before they fully drain a protocol. Bridge exploits, which used to account for the majority of DeFi losses, have largely receded, while flash-loan attacks, the dominant technique of 2020, now represent a small fraction of a percent of total losses. Immunefi also reported paying out approximately $13.45 million in bug bounties across 837 valid vulnerability reports in the same window, money spent finding bugs like Notional’s before someone else found them for free.
None of that makes April 2026 look any better in hindsight. It was the single most damaging month for DeFi hacks in more than a year, with losses approaching $630 million driven by a handful of major incidents, including a $292 million exploit against KelpDAO and a $285 million attack on Drift Protocol. The Notional exploit, at $1.73 million, barely registers next to those figures. But size isn’t the only metric that matters when deciding how much scrutiny to put on your own legacy contracts.
2026 DeFi Hack Landscape: Selected Incidents
| Incident | Approx. Loss | Primary Vector |
|---|---|---|
| KelpDAO (April 2026) | $292 million | DeFi protocol exploit |
| Drift Protocol (April 2026) | $285 million | DeFi protocol exploit |
| Notional Finance (Sept. 2026) | $1.73 million | Integer truncation / uint128 downcast |
| H1 2026 total (TRM Labs) | $972 million across 207 hacks | Mixed: smart contract, infrastructure, phishing |
| H1 2025 total (TRM Labs) | $2.3 billion across 83 hacks | Mixed, fewer but larger incidents |
| DeFi-only, 2022 peak (Immunefi) | $2.62 billion | Bridges, oracle manipulation, flash loans |
| DeFi-only, 2025 (Immunefi) | $680.3 million | Smart contract logic bugs, access control |
Market Impact: A Small Loss With an Outsized Signal
At $1.73 million, the Notional exploit was never going to move NOTE’s token price the way a nine-figure hack moves a protocol’s governance token. Trading in NOTE continued largely unaffected in the days after disclosure. What the exploit does move is something harder to price: confidence in the idea that a protocol’s “retired” contracts are actually retired.
DeFi’s total value locked has increasingly concentrated in protocols that have shipped multiple major versions over the years. Notional itself, along with peers like Aave and Compound, carries a version history stretching back to 2019 or 2020. Each new version tends to leave the old one deployed rather than self-destructing it, partly because withdrawing every last user’s funds cleanly is operationally difficult and partly because immutable contracts can’t simply be switched off. That leaves a long tail of dormant TVL sitting in contracts running years-old compiler versions, audited under years-old threat models, that nobody is actively monitoring for new attack techniques.
The market impact of the Notional exploit, then, isn’t really about Notional. It’s a preview of what auditors and insurers are going to start pricing into every protocol with a multi-version history: not just whether the current code is safe, but whether every contract a team has ever deployed and never swept is still safe, and whether the team actually knows what’s still sitting in it. Expect DeFi insurance underwriters and bug bounty programs to start asking that question explicitly in the coming months.
The Security Community’s Response
The response from the security research community was fast and largely convergent. SlowMist’s writeup walked through the exact sequence of the two mintfCashPair() calls and confirmed the truncation-to-zero mechanism as the root cause. QuillAudits published a parallel breakdown emphasizing that Notional had used safer, bounds-checked conversion patterns elsewhere in the same file, making the vulnerable line an inconsistency rather than a system-wide gap. That detail matters: it means the fix wasn’t a rewrite, it was a missed spot, exactly the kind of finding that a targeted line-by-line review of type conversions would have caught before deployment, and exactly the kind of finding that a broad, feature-focused audit is prone to miss.
Blockfence’s analysis reinforced the same conclusion from a slightly different angle, framing the exploit as a case study for why any contract still running Solidity 0.6.x needs an independent pass specifically targeting explicit type casts, not just the newer contracts a team is actively shipping. None of the write-ups suggest Notional’s team acted with anything other than the normal level of care teams apply to legacy code most users have forgotten exists. That’s precisely the point: normal care wasn’t enough, because the contract was never flagged as a live attack surface in anyone’s mental model after the V3 migration.
Lessons for Protocols Still Running Legacy Contracts
A handful of practical takeaways emerge from this incident for any team maintaining a DeFi protocol with more than one live version.
- Sweep or disable old contracts. If a version is deprecated, the safest state for it is empty. Migrating remaining balances out, even at the cost of some user friction, removes the incentive for anyone to go looking for bugs in code nobody maintains.
- Audit type conversions as their own category. Casts between signed and unsigned integers, and between different bit widths, deserve a dedicated audit pass rather than being assumed safe because the surrounding business logic looks correct.
- Track compiler version debt like technical debt. A contract still running Solidity 0.6.x in 2026 is running seven-year-old default arithmetic assumptions. That gap should show up on a security roadmap, not just a changelog.
- Treat dormant TVL as active risk. A contract with a balance and a working RPC connection is live, regardless of whether the team’s front end still points to it.
- Fund bug bounties for legacy code specifically. Immunefi’s $13.45 million payout for 837 valid bugs in H1 2026 shows that researchers will find these issues if there’s an incentive to look; the alternative is an attacker finding them for free.
Predictions: Where This Trend Goes Next
A few directions seem likely from here, based on where the data and the incident both point.
- More legacy-contract exploits surface through 2026 and into 2027. As more protocols reach their third or fourth major version, the population of dormant-but-funded old contracts keeps growing, and so does the attack surface they represent.
- Audit firms start selling legacy-sweep reviews as a distinct product. Expect firms like QuillAudits and CertiK to formalize a service specifically for auditing deprecated contracts for exactly this class of arithmetic bug, separate from a standard pre-launch audit.
- Average loss per DeFi incident keeps falling even as incident count rises. If the H1 2026 trend from TRM Labs and Immunefi holds, expect full-year 2026 numbers to again show more hacks than 2025 but a lower total dollar figure, continuing the multi-year decline in median loss size.
- DeFi insurers begin requiring proof of contract decommissioning. Coverage terms for protocol treasuries may start asking teams to show that deprecated versions have been swept or formally disabled, not just deprioritized in documentation.
- Solidity 0.6.x and 0.7.x contracts become a specific compliance flag. Expect on-chain risk-scoring tools to start explicitly surfacing pre-checked-arithmetic Solidity as a risk factor in protocol dashboards, similar to how outdated TLS versions get flagged in web security scans.
What This Means for Users of Lending Protocols
For the average DeFi user, the practical guidance out of this incident is straightforward, if a little unsatisfying. If you deposited funds into a protocol’s earlier version and never migrated when a new version launched, check whether that balance is still sitting there. Read the protocol’s migration announcements again if it’s been a while. A dormant position isn’t a safe position; it’s an unmonitored one, and this exploit is a direct demonstration of what that can cost.
It’s also worth remembering that this exploit required no user error at all. Nobody who lost funds through Notional’s escrow did anything wrong; the debt they were owed simply became collateral for someone else’s withdrawal because of a rounding error three versions removed from what most users interact with today. That’s a structural risk, not a user-education problem, and no amount of individual caution would have prevented it. The fix has to happen at the protocol level, which is exactly why sweeping and auditing legacy contracts needs to become a standard operating practice rather than an afterthought triggered by a $1.73 million loss.
Frequently Asked Questions
What is Notional Finance?
Notional Finance is a decentralized, fixed-rate lending protocol built on Ethereum. It uses a token called fCash to represent future cash flows, letting users lock in interest rates rather than accepting the variable rates common on protocols like Aave or Compound.
How much money was lost in the Notional Finance exploit?
Approximately $1.73 million, made up of 69,257.38 DAI and 1,658,524.86 USDC, was drained from Notional’s legacy V1 escrow contract on September 4, 2026.
What is an integer truncation bug?
It’s a flaw where a number too large for its target data type gets silently cut down rather than triggering an error. In this case, casting the value 2^128 into a uint128, which can only hold values up to 2^128 minus 1, caused it to wrap around to zero instead of reverting.
Was Notional Finance hacked before this incident?
Reporting on this incident does not reference a prior major exploit specific to Notional’s own contracts. The protocol’s V3 markets were affected indirectly in November 2025 when the Balancer exploit cascaded into connected vaults, which is part of why the team’s attention had already shifted toward newer versions and away from the V1 escrow.
Were the stolen funds recovered?
No recovery has been reported. The attacker converted the stolen DAI and USDC into approximately 689 ETH and routed the funds through Tornado Cash, and no source has confirmed the attacker’s identity.
How does this compare to other 2026 DeFi hacks?
It’s small. TRM Labs recorded 207 crypto hacks in H1 2026 totaling $972 million, and April 2026 alone saw a $292 million exploit against KelpDAO and a $285 million attack on Drift Protocol. At $1.73 million, Notional’s loss is roughly a rounding error next to those figures, though the underlying bug class is arguably more broadly applicable.
Could this type of bug affect other DeFi protocols?
Yes. Any contract that performs unchecked casts between signed and unsigned integers, particularly contracts still compiled with Solidity 0.6.x or earlier, carries similar risk. Both SlowMist and QuillAudits have framed this incident as a case study likely to prompt renewed scrutiny of type-conversion logic across other lending protocols.
What should DeFi users do to protect themselves after incidents like this?
Check whether you still hold a balance in an older version of any protocol you’ve used, migrate it to the current version or withdraw it if you’re not actively using it, and treat any dormant on-chain position as something that needs periodic attention, not something that’s safe simply because it’s been untouched.
