On June 19, 2026, at 7:15 AM UTC, mySwap's concentrated liquidity pools were exploited when an attacker created a fake EVIL token to manipulate pool accounting and share calculations. The attacker drained approximately $305K in liquidity (137.96 ETH, 45K USDC, 19.9K USDT, 230K STRK).

On June 19, 2026, at approximately 7:15 AM UTC, the mySwap CL (Concentrated Liquidity) protocol on Starknet was exploited, resulting in around $300,000–$305,000 being drained from its liquidity pools. The mySwap interface had been closed to new liquidity deposits for over six months, and the drained funds were mostly residual LP positions across more than 100,000 positions. The attacker bridged the stolen assets and used Railgun to obscure the transaction flow. The exploit nearly emptied all remaining liquidity in the protocol.