DoinGud NFT Diamond Bidding Contract Exploit

Summary

DoinGud was a Polygon-based, socially-conscious NFT marketplace and creator platform launched in 2021 and backed by venture investors including Alameda Ventures and CSP DAO. The project appears to have gone dormant and was reportedly acquired by a company called Cleo around January 2024, after which it stopped operating as an independent platform. A report circulating in security-monitoring circles alleges that on or around September 21, 2026, an attacker exploited a flaw in DoinGud's EIP-2535 'Diamond' bidding smart contract on Polygon — where the acceptBid function allegedly paid out a bid without marking it as consumed, letting the same bid be accepted twice — to drain roughly $35,486 in USDC.e. Despite extensive searching of security-incident trackers, hack databases, and news outlets, this investigation could not locate an independent, verifiable primary source (block-explorer transaction, security-firm postmortem, or mainstream news report) corroborating the exploit; it is treated here as an unverified, low-confidence allegation, while the platform's underlying dormancy and change of ownership are independently documented and support the broader concern about abandoned contracts holding live funds.