A reentrancy vulnerability in the PLX Locker smart contract exploiting ERC777 token callbacks allowed an attacker to recursively call withdraw functions and drain 500K worth of assets. The attacker bridged stolen funds to Ethereum before the team could patch the timelock-delayed fix.

The Polygon ecological project PolyDEX had a hacking incident. The hackers carried out a reentry attack on the Token Locker smart contract and stole about $500,000 worth of funds from the project.