Chi Protocol exploited on July 13, 2026 for ~$8.5K. Attacker flash-loaned 5 WETH, bought depegged USC from a thin Uniswap V2 pool, and burned it against the ReserveHolder. The burn() function assumed a $1 peg without checking, redeeming full-value collateral.

Chi Protocol (a DeFi stablecoin protocol issuing $USC backed by LSTs/LRTs on Ethereum) was exploited due to a logic error in the ArbitrageV5 contract’s burn() function. The attacker used a flash loan to buy heavily depegged $USC cheaply on a thin Uniswap V2 pool and burned it to redeem full-value collateral (weETH/stETH/WETH) at the hardcoded $1 peg, without the burn function checking the actual peg (unlike the mint function). This resulted in approximately $8,500 loss, nearly draining the protocol’s reserves.