Notional V1 lost about $1.7M from a deprecated escrow contract, says its post-mortem

What happened

Notional V1 is the first generation of a fixed-rate lending protocol on Ethereum. The team deprecated it in January 2022, but users could still withdraw, so some money stayed parked in its escrow contract.

On 3 September 2026 an attacker drained about 1.65 million USDC and 69,000 DAI from that escrow, and the team paused the contract soon after. Notional's post-mortem, published on 8 September, says nothing has been recovered and that no other Notional product is at risk.

What is confirmed

Everything below is from Notional's post-mortem unless marked otherwise.

• Date. The exploit happened on 3 September 2026 on Ethereum.
• Amount. Roughly 1.65 million USDC and 69,000 DAI. That is about $1.72M in total.
• What was hit. Residual assets in the legacy V1 Escrow contract. V1 was publicly deprecated in January 2022 after V2 launched.
• Response. The team investigated, upgraded the V1 contract and paused all operations.
• Recovery. Nothing has been recovered. The team is working with US law enforcement and the incident response firm Zero Shadow.
• Scope. The team says no other funds in any Notional product are at risk.
• Policy change. Future deprecations will include a way to migrate or return all user assets, so that no funds sit idle in old contracts.

Independent analysis

• Quill Audits, BlockSec and BeInCrypto all put the loss at about $1.73M.
• BeInCrypto and Foothold say the attacker converted the funds to about 689 ETH and sent them through Tornado Cash.
• Quill Audits says the attack needed no flash loan, no price manipulation and no stolen key.

How the bug worked

In plain words, and without code:

Notional V1 tracks positions as claims. Each trade creates a matching pair, one side owed and one side owed to. Before a trade, the contract checks that the account taking the debt can cover it.

The post-mortem says the attacker caused an integer overflow in a function that creates these pairs. That let them:

1. Create a very large debt in one account.
2. Bypass the collateral check on that account.
3. Move a matching claim, which had no real backing, to a second account.
4. Borrow against that claim and drain the escrow.

Account A  -> huge debt, but the check sees "no debt"
Account B  -> receives the matching claim (unbacked)
Account B  -> borrows real tokens against it

Third-party analysts add a detail. They say a very large debt value was cut down to fit a smaller number type. It then read as zero, so the check passed. Notional's own post-mortem does not go into this level of detail. Quill Audits also says the solvency check ran on the debtor side only.

What is not known

• Who the attacker is.
• Whether any funds can be recovered.
• How much user money is still in V1 now. The post-mortem does not say.
• What happens next for people who still hold V1 positions. The team says it will announce any distribution.
• Why the flaw was not found in earlier reviews. The post-mortem does not discuss audits.

Where sources disagree

• Date. The post-mortem says 3 September. BlockSec dates the activity 3 to 4 September UTC. BeInCrypto reports it as early Friday, 4 September. Olympix and ForkLog also say 4 September. Alphaday says 3 September.
• Amount. The post-mortem gives token amounts, which add to about $1.72M. Quill Audits, BlockSec and BeInCrypto say $1.73M.
• Cause wording. Notional says integer overflow. Analysts describe a silent cast that truncated a value to zero. Both describe the same family of bug.

Lessons for builders

• Treat legacy contracts as live. Notional says old contracts need the same scrutiny as production ones.
• Migrate or return user funds when a version is deprecated.
• Use checked arithmetic. Reject values that do not fit, instead of cutting them down.
• Check both sides of a trade. Solvency checks should cover every account that gains a claim.
• Keep a pause switch. The team could pause because the contract was upgradeable.
• Monitor old deployments the same way as new ones.

What users should do

• Check Notional's official channels for updates, especially if you still hold V1 positions.
• The team says no other Notional product is affected.
• Be careful with messages offering recovery help. Use only links from official accounts.

Sources: Notional's post-mortem, with Quill Audits, BlockSec and BeInCrypto. ThreatWire has not verified the figures on chain.