Exploit Details and Impact
Published 7/17/2026, 12:13:31 PM
As of July 17, 2026, DeFiTuna has not yet recovered the $580,000 lost in the Solana lending pool exploit, and no concrete compensation plan has been finalized. While the protocol has patched the vulnerability and tracked the stolen funds to two specific wallets, the lending pool remains at a deficit of approximately $570,000 to $580,000 USDC [Source: https://x.com/DeFiTuna/status/2078083605130039793].
Exploit Details and Impact
The exploit occurred on July 16, 2026, targeting a rounding flaw in DeFiTuna's pricing calculation. The attacker manipulated the protocol's solvency checks by creating a highly illiquid TUNA/USDC pool, causing the calculated asset value of their position to drop to zero and allowing them to withdraw borrowed USDC without liquidation [Source: https://x.com/Cryip_co/status/2078089161752637665].
The stolen funds (approximately 569,601 USDC) were split into two primary attacker wallets:
- Wallet 1: ~383,000 USDC
- Wallet 2: ~184,000 USDC [Source: https://x.com/CryptoCompassCo/status/2078078311004324189]
Current Protocol Status
While the lending side of the protocol is impaired, the core Automated Market Maker (AMM) remains operational.
| Metric | Value (as of July 17, 2026) | Source |
|---|---|---|
| Total Loss | ~$580,000 USDC | Source |
| $TUNA Price | $0.001247 (-31.61% 24h) | [Note: Market Data] |
| Lending Status | Paused (Borrowing disabled) | Source |
| AMM Status | Fully Operational | Source |
| Vulnerability | Patched | Source |
Recovery and Compensation Progress
There is currently no official roadmap or timeline for user reimbursement. The DeFiTuna team has stated that "securing user funds is the number one priority" but has not yet committed to a specific mechanism for filling the deficit [Source: https://x.com/DeFiTuna/status/2078083605130039793].
Community discussions and research suggest three primary paths forward, though none are confirmed:
- Treasury Backstop: Utilizing the protocol's existing treasury to cover the $580K gap.
- Socialized Loss: Implementing a "haircut" where the loss is distributed across all USDC depositors.
- White Hat Negotiation: Attempting to contact the attacker for a fund return in exchange for a bug bounty.
Conclusion: Recovery remains uncertain. While the technical flaw is fixed and the AMM is stable, the $580K deficit in the lending pool persists, and the $TUNA token has lost nearly a third of its value following the incident. No independent block-level confirmation of the exact exploit timestamp or a finalized recovery document has been released to date.