Cork Protocol exploit on 2025-05-28
Exploit on Ethereum, 28 May 2025. Last verified 4 Nov 2026.
major
Reported loss
Not in USD
see the amount as stated below
Recovered
-
nothing reported
Status
Not recovered
updated 26 Oct 2026
Date
Ethereum
Summary
On 2025-05-28 an attacker combined a rollover-pricing edge case with a malicious hook-like contract that bypassed authorization checks in the Cork Hook and FlashSwapRouter, extracting 3,761 wstETH from Cork Protocol's wstETH:weETH Liquidity Vault. Cork paused its contracts and later said most of the funds had not been recovered.
- Protocol
- Cork Protocol
- Type
- Exploit
- Reported loss
- 3,761 wstETH
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | 28 May 2025 | cork.tech ↗ |
| Amount | 3,761 wstETH | cork.tech ↗ |
| Cause | malicious hook-like contract bypassed authorization checks | cork.tech ↗ |
| Recovered | majority not recovered | cork.tech ↗ |
Primary sources
- Cork: May 28 2025 exploit post-mortem ↗ post-mortem · accessed 2026-11-04
- Cork: Post-incident lessons learned and actions taken ↗ official announcement · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram