Penpie exploit on 2024-09-03 ($27.3M reported)
Exploit on Ethereum, Arbitrum, 3 Sep 2024. Reported loss $27.3M. Last verified 4 Nov 2026.
major
Reported loss
$27.3M
as reported by the sources
Recovered
-
nothing reported
Status
Unknown
updated 26 Oct 2026
Date
Ethereum, Arbitrum
Summary
On 2024-09-03 an attacker exploited the reward-harvesting function of the Pendle yield booster Penpie with a malicious SY contract, stealing 11,113.6 ETH (about $27.3 million) from users on Ethereum and Arbitrum; Penpie later minted 31 million recovery tokens for compensation.
- Protocol
- Penpie
- Type
- Exploit
- Reported loss
- $27,300,000 · as stated: 11,113.6 ETH source: gov.magpiexyz.io ↗
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | September 3, 2024 | gov.magpiexyz.io ↗ |
| Amount | 11,113.6 ETH | gov.magpiexyz.io ↗ |
| Amount (USD) | approximately $27.3 million | gov.magpiexyz.io ↗ |
| Cause | malicious SY contract repeatedly harvesting market rewards | gov.magpiexyz.io ↗ |
| Compensation | 31 million #PRT tokens | docs.penpiexyz.io ↗ |
Primary sources
- Penpie team on the Magpie governance forum: incident overview ↗ governance post · accessed 2026-11-04
- Penpie docs: Penpie Recovery Token (PRT) ↗ official announcement · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram