9 Oct 2026 (UTC)
BitBay vault drained via zero-liquidity withdraw
Per SlowMist, a BitBay vault on Polygon paid its full balance when liquidity was zero; an attacker redeemed one share unit for ~14,838 DAI on 9 Oct 2026.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccounting
- Published
Loss, as sourced
~$14K (about 14,838.47 DAI), per SlowMist.
Traceability
Primary sources
- 01x.comSlowMist, 9 Oct 2026 03:28 UTC (opens in a new tab)
- 02polygonscan.comexploit tx (opens in a new tab)
In brief
Root cause: Per SlowMist: 'The Vault's _withdraw() function transfers its entire token balance when liquidity == 0, without limiting the payout to the user's proportional share.'
Timeline, as sourced: Exploit tx 9 Oct 2026 02:23:42 UTC (on-chain); SlowMist alert 03:28 UTC.
Account, as sourced
On 9 October 2026 an attacker took about 14,838 DAI from a BitBay vault on Polygon (transaction (opens in a new tab)). According to SlowMist (opens in a new tab), the vault's _withdraw() function transferred its entire token balance whenever liquidity was zero, without limiting the payout to the caller's share. The attacker pushed the vault into a zero-liquidity state through reposition(), then redeemed a single minimal share unit. No statement from BitBay was found.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/bitbay-vault-zero-liquidity-withdraw