Notional Finance suspected to have been hit by $1.7 million vulnerability

Notional Finance is suspected to have been hit by a $1.7 million hack, funds flowing to Tornado Cash

The blockchain investigation agency reported on September 4 that Notional Finance, a decentralized financial protocol, may have suffered a loss of approximately $1.7 million in a hack involving custody contracts. According to the disclosure, the damaged assets included approximately $69,242 in DAI and $1.66 million in USDC.

Details and Preliminary Investigation of Capital Loss

Researchers pointed out that a total of $1.7 million in DAI and USDC flowed out from Notion-related escrow contracts. According to Specter's research team, the specific losses consist of US$69,242 in DAI and US$1,658,423 in USDC.

Security company PeckShield cited Specter's findings, but at the time of final verification, Notional Finance had not publicly confirmed the incident. The technical reasons for the attack, the range of users affected, and the prospects for asset recovery have not been officially confirmed.

Specter's report pointed out that Notional Finance's custody contracts may have been exploited, resulting in the loss of approximately US$1.7 million worth of Ethereum eco-stablecoins (DAI and USDC). The suspect exchanged the stolen funds for 689.2 ETH and then deposited them into the coin mixer Tornado Cash. PeckShield said in the alert: "The Notional Finance escrow contract may have been utilized," while retaining a statement of uncertainty about the status of the event.

Analysis of Suspicious Addresses and Attack Methods

Specter identified two Ethereum addresses suspected of being involved in asset transfers: the first address was 0xC954... De69, and the second address was 0xDaCC... Ce38. Specter marked the addresses as "stolen addresses," but this description was only an inference by the investigating agency and was not confirmed by Notional Finance, law enforcement or the court.

The current report does not clearly indicate the specific hosting function modules involved, nor does it determine whether the incident was caused by a smart contract vulnerability, credential disclosure, wrong permission configuration, or other reasons. However, it is believed that the suspect exchanged DAI and USDC for approximately 689.2 ETH after the transaction and deposited the ether into Tornado Cash.

Tornado Cash is a collection of Ethereum smart contracts designed to reduce the visible correlation between deposits and subsequent withdrawals. While using such services complicates blockchain tracing, it does not independently prove criminal ownership or intent. Rapid conversion of stablecoins may also reduce the opportunities for issuers or centralized platforms to restrict assets. Although DAI and USDC can be publicly tracked before conversion, subsequent withdrawals from the mixer are more difficult to correlate with the original address.

Lack of official response and technical details

As of the verification time, Notional Finance has not released accident reports or confirmation information through its official channels. The project also did not disclose whether relevant contracts had been suspended, whether remaining assets had been protected, or whether users needed to take protective measures. Due to the lack of official confirmation, the reported loss of $1.7 million should be considered preliminary.

In addition, it is unclear whether the damaged assets belong directly to the user, the agreement treasury, or other parties using the custody contract. Without an official assessment, it is too early to attribute token price fluctuations or directly to changes in deposit values caused by this suspected attack.

Industry background and past cases

Decentralized financial projects often take measures such as suspending vulnerable contracts, contacting stablecoin issuers and exchanges, tracking associated wallets, and providing return agreements when an attack is suspected. However, these options may become more restricted once the asset enters the privacy agreement.

Despite this, some projects successfully restored positions or protected unaffected products after the attack. For example, Term Labs restored its affected fixed rate positions after a $8.5 million governance attack;Stake DAO also secured its Ethereum support and closed the bridge channel after an unauthorized casting incident. These cases all involve direct response measures to the project, but no similar situation has occurred in Notional Finance at present.

About Notional Finance and its Architecture

Notional Finance is an Ethereum-based lending agreement that focuses on fixed-rate, fixed-term lending business. Its documents explain that the currency deposited can support lending obligations denominated in other currencies. Therefore, contract-level accounting and collateral control are crucial to maintaining the solvency of user positions. However, researchers have not yet determined whether the reported custody incident affected Notional's primary lending system, separate integrated modules or older contracts.

DAI and USDC have long been part of Notional-backed lending markets. The technical materials of the agreement describe the currency pairs that connect these stablecoins to their interest-bearing equivalents. As a result, the reported losses relate to assets used in Notional's broader lending structure, but available evidence does not suggest that open loans, collateral balances or fixed-term positions were affected. Official contract identification is required to accurately measure risk exposure.

Future Outlook

Subsequent confirmation updates may need to clarify which contracts are involved, how the transaction is authorized, and whether other funds are still at risk. Post-mortem analysis also helps clarify the ownership of lost assets. Investigators may continue to track any ether extracted from Tornado Cash. Exchanges and blockchain analytics companies may monitor subsequent transactions, but reported mixer deposits make attribution and recovery more difficult. Before Notional released the evaluation, the scale, cause and impact on users of the incident remained unresolved.