On December 4, 2024, Vestra DAO's staking contract was exploited less than a month after launch when the unStake() function failed to validate whether a position was still active. The attacker repeatedly extracted rewards from already-unstaked positions, stealing 73.7 million VSTR tokens (~$500K).

Vestra DAO tweeted that a hacker exploited a vulnerability in the locked staking contract, manipulating the reward mechanism to claim rewards exceeding their entitlement. As a result, a total of 73,720,000 VSTR tokens were stolen. The stolen tokens were gradually sold on Uniswap, causing approximately $500,000 in ETH liquidity losses.