Integer Overflow Bug Leads to $1.73M Theft on Notional Finance

Early on Friday, a coding vulnerability allowed an attacker to siphon around $1.73 million from a legacy escrow contract tied to Notional Finance. The flaw caused an artificially large debt to appear as zero.

The stolen DAI and USDC were swapped into approximately 689 ETH. That ether was subsequently sent through Tornado Cash, a mixer that obscures transaction trails. So far, Notional has not issued any public comment.

#CertiKInsight 🚨

We have seen an ~$1.7M exploit on @NotionalFinance.
https://t.co/luKD7RcbVA

The attacker used two mintfCashPair() calls to create a -2^128 liability, which was truncated to 0 by an unsafe uint128() downcast in free-collateral valuation.

Stay Vigilant! pic.twitter.com/5T7E0XQfWJ

— CertiK Alert (@CertiKAlert) September 4, 2026

The Mechanism Behind the Notional Finance Exploit

Notional Finance operates as a fixed-rate lending protocol on Ethereum. In its first version, future cash obligations were recorded as tokens called fCash. The system would check borrowers for collateral before permitting additional debt.

That screening converted debt into ether values using an unchecked uint128 conversion. Two mint operations added up exactly to 2 raised to the power of 128. According to QuillAudits, this is the one value that the conversion flattens to zero.

A checked conversion would have refused the number instead of silently truncating its digits. The write-up notes that Notional used the safer method elsewhere in the same code file.

After that, the account appeared to have zero debt. Etherscan records show the setup transaction occurred at 11:58 p.m. UTC on Thursday, with the withdrawal following three minutes later.

That second transaction moved 69,257 DAI and 1,658,524 USDC out of the escrow. The attacker also paid block builder Titan 0.07 ETH to have the trade processed privately.

Security firm PeckShield relayed an alert from on-chain monitor Specter. The escrow now holds roughly $60,600 in leftover tokens.

#PeckShieldAlert Specter has reported that the Notional Finance escrow contract may have been exploited, resulting in $1.7M in ethereum:0x6b175474e89094c44da98b954eedeac495271d0f and $USDC lost.
The exploiter has swapped the stolen funds into 689.2 $ETH and deposited them into… pic.twitter.com/Wd5Dc3MWtL

— PeckShieldAlert (@PeckShieldAlert) September 4, 2026

Inactive V1 Contracts Still Held Real Funds

Notional decommissioned its third version after the November 2025 Balancer exploit cascaded into its vaults. The V1 contracts remained live and funded, with no one moving the assets.

Protocols that have undergone independent audits still account for the majority of crypto hack losses, so an earlier audit offered no protection here. A similar incident occurred in June when an attacker drained legacy Solana pools at Raydium.

The NOTE token of Notional is trading around $0.0065, up 3.5% over the past 24 hours, with a market capitalization close to $400,700.

As of publication, Notional had not issued any statement, loss figure, or post-mortem. It remains unclear whether the drained funds belonged to users, the treasury, or a third party.