Hector Network's compensation contract for token holders was exploited when a malicious account deposited only 0.0001 HEC and then transferred $2.7M worth of assets to itself. The vulnerable AddEligibleWallet function allowed the attacker to designate arbitrary addresses as eligible and drain the treasury via mintWithdraw and transferRedemption functions.

Another $2.7 million is gone after an apparent thief was able to exploit a smart contract that was intended to distribute payouts to Hector's token holders. They then swapped the tokens from the USDC stablecoin to ETH. Investors in the project are furious, especially because various parties had warned Hector Network about apparently insecure practices. Hector Network's team, meanwhile, have not acknowledged the theft, although a law firm involved in the project liquidation promised a statement would be forthcoming.