ChainBleedv0.1 · open intel
← back to feed·2021-08-03 · 4y ago
Incident · CHAINSEC

Popsicle Finance

Exploit
Estimated loss
$25.00M
VERDICT —UNRATED
Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.
▰ METHOD
Undisclosed
Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

▰ PROOF OF CONCEPT
DEFIHACKLABS
src/test/2021-08/Popsicle_exp.sol
view forked test on github ↗

Reproducible Foundry test fork from SunWeb3Sec/DeFiHackLabs. Clone the repo, run forge test against the file path above, and replay the exploit against a mainnet fork at the historical block. Use for reproduction only — not for live targets.

Forensic narrative

Popsicle Finance, a multi-chain yield-generating crypto project, has melted under the heat of a new exploit. The $25 million heist was revealed by security researcher Mudit Gupta, who said “the hack was complex but the bug was simple. Reported loss: $25,000,000.

Primary source
https://decrypt.co/77620/defi-protocol-popsicle-finance-hacked-25-million
Sourced from
chainsec
Technical record
chain
protocol
Popsicle Finance
bug_class
unknown
date_occurred
2021-08-03
loss_usd
$25,000,000
source_id
cs:popsicle-finance::2021-08-03
Related — same bug class
2026-05-16
25d ago
ETH
Adshares
Bridge-Minter Fake-Mint Exploit (wADS)
bridge
$628.0K
AMBIGUOUS
2026-05-15
26d ago
MULTI
THORChain
Cross-Chain Router Exploit (multi-chain drain)
bridge
$10.70M
AMBIGUOUS
2026-05-13
27d ago
BSC
Mail Token
BSC token contract exploit (vector undisclosed)
accounting
$54.6K
UNRATED
2026-05-13
27d ago
ARB
ShapeShift FOX Colony (Colony Network)
executeMetaTransaction → resolver-repoint via setTarget → delegatecall drain
access-control
$132.7K
AUDIT-CATCHABLE
2026-05-13
28d ago
ETH
Transit Finance
Contract Vulnerability
logic
$1.88M
UNRATED
2026-05-13
28d ago
ETH
TAC Cross-Chain Layer (TON Side)
Contract Vulnerability
logic
$2.80M
UNRATED
ChainBleed — live web3 threat intelligence