8 Oct 2026 (UTC)
X7 Finance X7Pioneer drained via reward double count
Per SlowMist, X7Pioneer's claimRewards() re-added the same unaccounted ETH on every empty call; an attacker took ~6.78 ETH on 8 Oct 2026.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccounting
- Published
Loss, as sourced
~6.78 ETH, per SlowMist.
Traceability
Primary sources
- 01x.comSlowMist, 8 Oct 2026 10:28 UTC (opens in a new tab)
- 02etherscan.ioexploit tx (opens in a new tab)
In brief
Root cause: Per SlowMist: 'In claimRewards(), totalRewards is incremented by (address(this).balance - lastETHBalance) on every call, but lastETHBalance is only updated when claimable > 0.'
Timeline, as sourced: Exploit tx 8 Oct 2026 09:55:59 UTC (on-chain); SlowMist alert 10:28 UTC.
Account, as sourced
On 8 October 2026 an attacker drained about 6.78 ETH from X7 Finance's X7Pioneer contract on Ethereum (transaction (opens in a new tab)). According to SlowMist (opens in a new tab), claimRewards() added the contract's balance minus lastETHBalance to totalRewards on every call, but only updated lastETHBalance when something was claimable. Calling it with an empty array left the claimable amount at zero, so the same unaccounted balance was added again on each call, inflating the per-token reward. SlowMist says the attacker also sent ETH to the contract to enlarge the difference before draining it. No statement from X7 Finance was found.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/x7-pioneer-claimrewards-double-count