Gondi V3 exploited March 9, 2026 when the Purchase Bundler lacked caller verification. Attacker drained 78 NFTs (~$230K) with lingering approvals from prior loan operations by calling the unprotected buy() function.

Gondi V3 NFT lending protocol’s “Sell & Repay” contract (Purchase Bundler feature) was exploited. The attacker bypassed ownership checks due to an access control flaw and stole escrowed NFTs (approximately 78 NFTs) worth ~$230,000. The team disabled the vulnerable contract and committed to compensating affected users; other platform functions remained unaffected.