SpankChain payment channel hub was exploited via a reentrancy vulnerability on October 6, 2018. An attacker created a malicious token contract masquerading as an ERC20, with a transfer function that called back into the payment channel contract multiple times, draining approximately 165.38 ETH (~$38,000). The attacker returned the stolen funds after negotiation.