Purrlend’s $1.5M Feline Fiasco: A Tale of Tails and Tokens

by

Ah, the theater of DeFi! Purrlend, that noble lending protocol, hath lost $1.5M in a most comical exploit. Behold the folly on HyperEVM and MegaETH, where wallets weep and tokens flee!

Purrlend, a protocol of grand ambition, built upon the stages of HyperEVM and MegaETH, hath suffered a most grievous exploit. Alas, the attackers, those scoundrels of the blockchain, hath drained a tidy sum of $1.5 million from both networks. A tragedy, you say? Nay, a farce!

The root of this mischief? A suspicious admin multisig transaction, a move as subtle as a clown’s pratfall. It granted unauthorized bridge privileges, a key to the treasury, mere hours before the attack. Oh, the folly of trusting unknown addresses!

The protocol, in its wisdom, hath paused all operations and launched an investigation. A wise move, though it doth little to soothe the wounded wallets.

How the Purrlend Admin Wallet Update Triggered the Exploit

At the stroke of 1:20 a.m. UTC, a transaction of great import occurred. The admin multisig, in a moment of madness, updated borrowing caps and assigned roles to an address as mysterious as a masked courtier. This address, a true villain of the piece, later received bridge privileges, enabling the minting of tokens without collateral. A scheme as bold as it is absurd!

Such access, in the delicate world of DeFi, is as dangerous as a jester with a dagger. Granting it to an unverified address opened the floodgates for a mass extraction of funds. The community, ever vigilant, flagged the activity as suspicious. Yet, who authorized this folly? The question hangs in the air like a poorly timed punchline.

We have detected irregular activity on the protocol and are actively investigating. The protocol has been paused for the time being. Please proceed with extra caution in the meantime. Further updates will be posted from this account.

– Purrlend (@purrlend)

Purrlend, in its official decree, confirmed the irregular activity. The team, with great solemnity, declared the protocol paused and promised updates. Yet, no technical breakdown hath been released, leaving us all in suspense.

Breakdown of Stolen Funds Across HyperEVM and MegaETH

On-chain analyst kirbycrypto, a true detective of the blockchain, hath broken down the stolen assets in detail. HyperEVM, the larger victim, lost $1,197,488 in total. This included 449,683 USDC, 214,125 USDT0, and 194,745 USDH, among other tokens of lesser fame. MegaETH, not to be outdone, recorded losses of $324,549, with attackers taking 163,169 USDT0, 36.8 WETH, and 75,745 USDm.

Combined, the total reached approximately $1.52 million. Kirbycrypto, in a display of scholarly rigor, published the full breakdown on X, citing wallet-level transaction data.

Purrlend appears to be exploited on both MegaETH and HyperEVM.

Attacker made off with: 449,683.8748 214,125.3752 $USDT0194,745.1368 2.0477 1,581.3418 19.6052 868.4795 757.0228 Total: $1,197,488.33 on HyperEVM

+

163,169.1587…

– kirbycrypto (@kirbyongeo)

The assets targeted were primarily stablecoins and wrapped tokens, the low-hanging fruit of the DeFi orchard. Their ease of movement across chains made them irresistible to the attacker, a true connoisseur of liquidity.

Read Also:

Another DeFi Blow: Volo Protocol Hit by $3.5M Hack, Freezes Vaults on Sui

Community Reaction and DeFi’s Rough April Continues

The community, ever vocal, responded with frustration across social platforms. Some pointed to prior red flags, such as the heavy promotion of the protocol before MegaETH’s token event. Others whispered of an inside job, though proof remains as elusive as a ghost in a comedy.

No funds have been recovered, and the Purrlend team hath not shared a recovery plan. The investigation continues, a slow dance of discovery. This incident adds to a difficult stretch for DeFi, with April alone seeing over $600 million in losses. Purrlend joins a growing list of protocols caught in security breaches, raising concerns about access control in DeFi governance.

Ah, the theater of DeFi! Where wallets weep, tokens flee, and folly reigns supreme. Will Purrlend recover? Only time, and perhaps a bit of divine intervention, will tell.

Read More

2026-04-25 19:06