Investigators revealed that the compromised module accepted a publicly available string as proof of message validity, allowing attackers to execute malicious transactions without obtaining wallet owner signatures. The stolen assets were later converted into DAI through attacker-controlled liquidity pools, making recovery efforts more difficult.

The exploit adds to a growing list of security incidents affecting the crypto industry in 2026. While audits remain a critical part of protocol security, recent attacks continue to show that operational configurations, third-party modules, and trusted integrations often present risks that are just as significant as vulnerabilities in smart contract code.