Morning Edition · Monday, October 5, 2026Published at 1:31 AM EDT · New York

Uniswap v4 hook rebalancing flaw drains about $115,000 from GoldPesa on Base, and MALT loses treasury DAI on Polygon

In both attacks, a protocol-funded rebalance ran inside a user's swap without separating the protocol's capital from the caller's, and attackers used flash loans to capture the difference.

GoldPesa (Base, about $115,000). On October 2, an attacker took about 115,000 USDC from the Uniswap v4 pool manager through GoldPesa's GPXHooks contract, The Crypto Times reported. Researchers at DeFiHackLabs published a proof-of-concept (a…