Top 3 DeFi Incidents in January
Truebit Protocol: ~$26M
On January 8, 2026, Truebit Protocol on Ethereum was exploited, resulting in approximately $26 million in losses. This incident underscores the critical importance of robust smart contract security.
The root cause was an integer overflow vulnerability in the TRU token purchase pricing function. The contract was compiled with Solidity v0.6.10, which does not enforce overflow checks by default. The attacker crafted input parameters that caused a large intermediate value in the purchase cost calculation to overflow and wrap around to a much smaller number. This allowed the attacker to purchase large amounts of TRU tokens at minimal or even zero ETH cost.
The attacker performed multiple rounds of arbitrage within a single attack transaction, repeatedly executing buy and sell operations on TRU tokens. Notably, the protocol had intentionally designed pricing asymmetry between buying and selling to prevent immediate buy-sell arbitrage. However, the vulnerable contract was deployed using an outdated Solidity version without overflow protection, exposing the attack surface and ultimately leading to the draining of 8,535 ETH from protocol reserves.
Secure Your dApp with BlockSec's Smart Contract Audit
Don't let vulnerabilities like integer overflows threaten your protocol. Our expert team conducts thorough smart contract audits to identify and mitigate risks before they become costly exploits.
Best Security Auditor for Web3
Validate design, code, and business logic before launch
SwapNet & Aperture: ~$17M
On January 25, 2026, SwapNet and Aperture Finance suffered attacks stemming from a shared vulnerability, resulting in approximately $17 million in total losses. The attack significantly impacted Matcha Meta users, with affected funds exceeding $13 million.
Although both affected contracts were closed-source, the attack paths could be reconstructed by analyzing decompiled bytecode alongside on-chain transaction traces. The root cause was insufficient validation on crucial user inputs within vulnerable functions, allowing attackers to execute arbitrary calls with malicious parameters. In a series of attack transactions, attackers constructed ERC20 transferFrom() invocations to drain tokens from users who had previously granted token allowances to the vulnerable contracts. This highlights a common DeFi security risk.
Both protocols involved in this attack did not open-source their code, making it difficult for the community to identify security vulnerabilities through public review. Meanwhile, the allowance-based attack approach serves as a wake-up call for the industry: users must carefully manage their token allowances, while protocols should implement protective mechanisms such as time-locked or capped approvals to fundamentally mitigate the risks of such attacks.
Learn more details about the incident
Phalcon Security: Real-Time Threat Monitoring and Attack Prevention
Stay ahead of sophisticated attacks like those on SwapNet and Aperture. Phalcon Security provides real-time monitoring and alerts for suspicious on-chain activity, helping you detect and prevent exploits.
Saga: ~$7M
On January 21, 2026, SagaEVM in the Saga ecosystem was exploited, resulting in unauthorized token minting and a loss of approximately $7 million. This incident underscores the importance of robust blockchain security across all layers.
While the root cause has not yet been fully disclosed, official sources have confirmed that a shared vulnerability in Ethermint and CosmosEVM code, which was inherited by SagaEVM—led to the attack. The attacker deployed malicious smart contracts to execute the exploit, minting a substantial amount of Saga Dollars. Following the successful attack, nearly all stolen funds was swiftly transferred to the Ethereum network via cross-chain bridges.
This incident highlights the risks of code inheritance in blockchain ecosystems. When vulnerabilities exist in foundational codebases, all projects inheriting that code may face the same threats, creating cascading security vulnerabilities. Comprehensive infrastructure audits are crucial for such ecosystems.
The information above is based on data as of 00:00 UTC, January 31, 2026.
This concludes the January security incidents brief. For more in-depth analysis of blockchain security incidents and Web3 security trends, you can explore our resources.
You can learn more in our Security Incidents Library.
Stay informed and stay secure!
