On April 20, 2026 Thetanuts Finance's vault contract on Ethereum was exploited for $50,000 via a first-depositor inflation flaw: an attacker minted 1 share, donated 1,000 ETH directly to the contract, then redeemed the share for nearly all vault assets when the next user deposited.

A newly deployed vault contract of Thetanuts Finance was exploited via a First Depositor Attack. The attacker took advantage of the vault’s share calculation logic when totalAssets and totalSupply were both 0 at initialization: they deposited a minimal amount (e.g., 1 wei) to mint 1 share, then directly transferred a large amount of assets (e.g., ETH) to the contract, manipulating the asset-to-share ratio. When subsequent users deposited, they received almost no shares, allowing the attacker to redeem their single share for nearly all the vault’s assets. The loss was approximately $50,000. The protocol focuses on on-chain options and yield vaults; this incident affected a specific new vault.