# Rounding Bug Drains a Legacy Set Protocol Vault as Losses Spread From Contract Code to Hot Wallets and Bridges

The Set Protocol loss of about 8 WETH is small. In the same period, Bitget lost $387.5 million through hacked security appliances, and a Nomic bridge bug left a wrapped bitcoin about 36% unbacked.

- Published: 2026-10-13T05:42:08.752Z
- Canonical: https://polylog.news/crypto/2026-10-13/rounding-bug-drains-a-legacy-set-protocol-vault-as-losses-sp
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/e1e641e71ff42d79104bb88029f6055cfd7df84c), [Rekt News (NEAR Intents)](https://www.rekt.news/), [KuCoin News](https://www.kucoin.com/news/flash/old-set-protocol-product-ethmacoapy-loses-8-11-weth-in-attack), [CoinDesk](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues), [Hokanews](https://www.hokanews.com/2026/09/osmosis-freezes-2265-btc-after-nomic.html), [BleepingComputer](https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/), [BeInCrypto](https://beincrypto.com/crypto-hack-losses-september-2026-bitget/)

The latest reconstruction in the [DeFiHackLabs repository](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/e1e641e71ff42d79104bb88029f6055cfd7df84c) covers ETHMACOAPY, a legacy Set Protocol vault on Ethereum. The vault [lost about 8.11 WETH across two attacks on October 6](https://www.kucoin.com/news/flash/old-set-protocol-product-ethmacoapy-loses-8-11-weth-in-attack). The flaw is a rounding bug. Anyone can call the actualizeFee() function, with no owner or role check. The function recalculates the vault's stored share value using division that rounds up. The attacker deposited funds, donated extra collateral to widen the rounding error, triggered the recalculation, and then redeemed more collateral than they had put in. The difference came out of other holders' reserves. No freeze or recovery has been reported. The case adds to a pattern of attacks on deprecated contracts that teams stopped maintaining but never shut off.

NEAR Intents, a cross-chain trading service, [lost $3.8 million on October 1](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues). A bug in how its smart contract interacted with Omni's custody system allowed unauthorized withdrawals from a hot wallet on BNB Chain. Deposits and withdrawals were restricted on 11 networks. Illia Polosukhin, a NEAR co-founder, said the attacker returned the money about a day after the team made contact, and that users will be reimbursed in full. [Rekt News](https://www.rekt.news/) has written up the incident.

The Nomic case shows how slowly bridge failures can come to light. An attacker combined two bugs in Nomic's custom forwarding mechanism to double-spend nBTC, Nomic's wrapped bitcoin token. That created 40.65 BTC of claims with no bitcoin behind them, and the attacker sent them to Osmosis on June 25. Osmosis took 74 days to notice. By then, 39.84 of those unbacked nBTC made up about 36% of the backing of Alloyed BTC. Osmosis validators then ran an emergency upgrade that [froze 22.65 BTC at the attacker's address](https://www.hokanews.com/2026/09/osmosis-freezes-2265-btc-after-nomic.html).

The largest losses in recent months came from operational infrastructure. Bitget lost $387.5 million from hot and warm wallets after attackers used zero-day exploits on two third-party security appliances to reach its wallet system, according to investigations by SlowMist and Mandiant [reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/). [BeInCrypto](https://beincrypto.com/crypto-hack-losses-september-2026-bitget/) calls it the year's largest theft. The crypto casino Duelbits lost about $7 million in a suspected compromise of hot-wallet private keys on several chains. Nostra, a lending market, lost $3.5 million to oracle manipulation. SingularityNET reported that an attacker accessed its cloud infrastructure. Rekt News has covered all of these.

## What this means

The losses are now concentrated in three places: deprecated contracts nobody watches, bridge logic that creates claims without verified backing, and the hot-wallet and cloud systems around exchanges. Audits of live contract code catch none of these well. Exposure falls on holders of wrapped assets, users of exchanges that run large hot wallets, and anyone with idle funds in legacy vaults. The return of funds in the NEAR case and the Osmosis freeze show the market has tools after the fact. Both relied on centralized intervention, either negotiation with the attacker or a validator upgrade that froze funds. The 74-day delay in the Nomic case suggests wrapped-asset backing is checked far less often than users assume. The desk expects losses to stay high for months, with the largest single losses coming from infrastructure breaches like Bitget's rather than from contract bugs. Protocols are likely to respond by shutting down or emptying legacy contracts and publishing proof-of-backing for wrapped assets. That read would be wrong if the next nine-figure loss came from a reviewed, actively maintained contract rather than from operational systems.

## What to watch

- Whether Set Protocol's maintainers or similar legacy projects publish lists of deprecated contracts that still hold funds. Those vaults are now being targeted one at a time.
- How Alloyed BTC on Osmosis covers the hole left by unbacked nBTC. The outcome will set expectations for other multi-source wrapped bitcoin products.
- Whether other exchanges disclose compromises of the same security appliance vendors used against Bitget. Shared tools mean shared exposure.