On June 17, 2025, Meta Pool's ERC4626 vault contract on Ethereum was exploited via an unprotected mint() function in Staking.sol. An attacker called the public mint function to create 9,705 mpETH tokens (~$27M at face value) without depositing collateral, extracting only $130K due to low liquidity in affected pools.

An attacker exploited a vulnerability in the staking contract for Meta Pool, which is a liquid staking project. This allowed them to mint 9,700 mpETH, the project's liquid staking token, which is notionally worth $27 million. However, very low liquidity for the token meant that the attacker was only able to swap 10 ETH (~$25,000) of tokens.