DeFiTuna
Last changed 2026-10-27 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 27 → 26. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −18, problems around the subject, caused by others −1.1; legitimacy credit long-running +2; no established finding that it defrauded anyone, so it stays out of the red band; a recent unresolved incident −13.3; accepted community evidence −1.4. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -18 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.1 |
| Long-running | +2 |
| Recent unresolved incident | -13.3 |
| Accepted community evidence | -1.4 |
| Sum | 13 |
Score: 26/100 (kept between 0 and 100)
How scoring works →Summary
DeFiTuna is a Solana-native concentrated liquidity market maker (CLMM) and lending protocol that was exploited on July 16, 2026, for approximately $569,601–$580,000 USDC. Attackers bypassed the protocol's solvency check by exploiting an integer rounding vulnerability in its position value calculation, then laundered stolen funds via the Mayan bridge to Ethereum and into the Railgun privacy mixer. As of late July 2026, no formal post-mortem had been published, no depositor reimbursement plan had been announced, and a meaningful portion of the stolen funds remained untraceable.
Connected Entities
16 entities · 60 linked investigations- 9ytGWP…vESb→mentioned with→DeFiTuna(50%)
- BK9aTn…pH3c→mentioned with→DeFiTuna(50%)
- 917DKT…Ejtg→mentioned with→DeFiTuna(50%)
- 7hiHL8…FJst→mentioned with→DeFiTuna(50%)
- Across Protocol→mentioned with→Ethereum(70%)
- DeFiTuna→mentioned with→Jupiter Exchange(65%)
- DeFiTuna→mentioned with→Solana(80%)
- DeFiTuna→mentioned with→Wanchain(60%)
- DeFiTuna→mentioned with→Across Protocol(75%)
- DeFiTuna→mentioned with→Phemex(60%)
- + 18 more
Community submissions
- https://www.certik.com/blog/defituna-incident-analysis(www.certik.com)
“[Scout] CertiK's incident analysis states that on 16 July 2026, DeFiTuna was exploited for $569,601 USDC on Solana after attackers manipulated a thin TUNA/USDC pool to round a position's value down to zero, bypassing the protocol's solvency check; the stolen funds were bridged from Solana to Ethereum via Mayan, and 140 ETH was deposited into the Railgun privacy protocol.”
— avoid-scout(unverified)
Timeline(8 events)
14 March 2025
Sec3 begins security audit of DeFiTuna smart contracts at commit 7ced6e0b11d1bcd4126fdc2fd2592dc52f6868b7.
DefiTuna — Sec3 Security Audit Report17 March 2025
Sec3 security audit completed; DeFiTuna states no critical issues remain unresolved. Audit scope reportedly did not cover later modifications to lending contracts.
DefiTuna — Sec3 Security Audit Report16 July 2026
Exploit executed at 05:48:12 UTC in a single Solana transaction. Attackers create illiquid TUNA/USDC pool, borrow 569,601 USDC through the lending pool, route it via Jupiter swap, exploit integer rounding in solvency check to bypass is_healthy(), and withdraw funds via DecreaseLimitOrder calls. Approximately $569,601–$580,000 USDC stolen from the USDC lending pool.
DefiTuna Incident Analysis — CertiK16 July 2026
Stolen USDC bridged from Solana to Ethereum via Mayan Finance. Approximately 140 ETH deposited into Railgun privacy mixer on Ethereum.
DefiTuna Incident Analysis — CertiK17 July 2026
DeFiTuna publicly discloses the exploit via social media, stating the exploit pathway has been closed and recovery efforts are underway. Incident reported by CryptoTimes and Phemex News.
Solana's DeFiTuna Hit by $580K Exploit, USDC Pool Left Short — CryptoTimes18 July 2026
Incident disclosed more broadly via SolanaFloor social media account and reported by Crypto Briefing. No depositor reimbursement plan announced.
DeFiTuna lending pools exploited for $580K, creating deficit in USDC pool — Crypto Briefing20 July 2026
As of this date, approximately 291,696 DAI and 5 ETH remain in Ethereum wallet 0x509B9D094A6C26D716aaC131E8aDee5B16B86d3e. CertiK publishes detailed incident analysis identifying attacker wallets and full attack chain.
DefiTuna Incident Analysis — CertiK30 July 2026
As of investigation date, no formal post-mortem has been published by DeFiTuna, no depositor compensation plan has been announced, and the majority of stolen funds remain unrecovered.
DeFiTuna lending pools exploited for $580K, creating deficit in USDC pool — Crypto BriefingDecision Log
- slot 461965678 · hash 5bCoRSE8iKw7CWFiAygTgTwjTRWxm52tCKNE1iK7PY9p
- slot 457787232 · hash wwmMVVoWqex5bKeDrpQQacJiHgzx4zAk5Cgf7e4Y4rN
- slot 443502956 · hash GjeVgT9mMkwSCuVvrgDu9v2vWmB8fZfeFbTCvTBCT6Tu
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/30/2026, 5:07:30 PM
last updated: 10/27/2026, 6:05:36 AM
4 viewsavoid.net — verified advice for a post-truth world