Notional Finance Loses $1.73M in Ethereum (ETH) via Integer Overflow Exploit

Integer Overflow Turns Debt to Zero

An attacker drained roughly $1.73 million from Notional Finance's legacy escrow contract early Friday, exploiting an integer overflow bug that made an enormous fabricated debt register as zero. Notional Finance is a fixed-rate lending protocol on Ethereum, and its first version recorded future cash obligations as tokens called fCash. Before a borrower could add debt, the system screened for collateral — a check that converted the obligation into ether terms through a raw uint128 conversion. Researchers who traced the incident found that two mints summed to exactly two raised to the power of 128, the single value that this conversion flattens to zero. A checked conversion would have rejected the figure instead of quietly dropping its digits; tellingly, the protocol used the safer checked method elsewhere in the same file. Once the overflow landed, the attacker's account read as debt-free. On-chain records show the setup transaction landed at 11:58 p.m. UTC on Thursday, with the withdrawal following just three minutes later — a two-step sequence verifiable on Etherscan. That second transaction moved 69,257 DAI and 1,658,524 USDC out of the escrow — two dollar-pegged stablecoins that DeFi users routinely deploy as yield-bearing stablecoin collateral. The attacker also tipped block builder Titan 0.07 ETH to route the trade privately, a small bribe that kept the transaction out of the public mempool and gave the protocol no window to react. The arithmetic is unforgiving: a single unchecked cast in code that had sat untouched for years was enough to convert a fabricated number into a seven-figure payout. Because the escrow contract never swept its residual balances, the funds simply sat in place until Friday's transaction arrived.

689 ETH Routed Through Tornado Cash

The stolen DAI and USDC were swapped into approximately 689 ether (ETH) and pushed through Tornado Cash, the mixing service that breaks the trace between wallets — a corner of the ecosystem adjacent to the zero-knowledge privacy layer that protocols such as Aztec Network pursue through compliant designs. Security firm PeckShield relayed a warning from on-chain monitor Specter shortly after the drain, and on-chain data now shows the escrow holding roughly $60,600 in leftover tokens. The target itself tells the deeper story. Notional wound down its third version after the November 2025 Balancer exploit cascaded into its vaults, yet the V1 contracts stayed live and funded, and nobody ever swept them. That left a dormant ledger holding real money — the same pattern seen in June, when an attacker drained legacy Solana pools at Raydium. The lesson compounds: independently audited protocols still account for the majority of crypto hack losses, so an old audit report offered no protection here. Tornado Cash deposits of this size are typically dispersed across hundreds of addresses over days, making recovery prospects slim. Market reaction has been muted to the point of indifference. NOTE, the protocol's token, trades near $0.0065, up 3.5% over 24 hours, on a market value of roughly $400,700 — a valuation that reflects how little economic activity remains attached to the brand. As of publication, Notional had issued no statement, no confirmed loss figure and no post-mortem, and whether the drained funds belonged to users, the treasury or a third party remains unconfirmed. For depositors, the episode is a fresh argument for holding idle funds in a cold wallet rather than leaving them in contracts nobody maintains. Readers tracking the market in real time can follow live spot and futures prices on Gate.

The Unanswered Ownership Question

Our reading of the primary evidence is straightforward. The attacker's withdrawal is a matter of public record on the Etherscan ledger, the drained amount — roughly $1.73 million — is verifiable on-chain, and the root cause is documented in the overflow arithmetic itself: a raw uint128 cast that silently erased a value a checked conversion would have rejected. Remediation is equally clear — checked math everywhere, and sweeping legacy contracts before they mature into liabilities. What remains missing is the team's own post-mortem. Until Notional publishes one, the ownership question stays open, and the funds, now in ETH, are unlikely to surface on any compliant crypto exchange.