NovaBox’s reward pool on Ethereum was hacked on June 9, resulting in a loss of about 56.73 ETH and affecting more than 130 deposit users.
According to ChainCatcher, Bits.media reported that the attacker emptied the pool from 65.11 ETH to 0.09 ETH in a single transaction, draining about 99.86% of the funds.
Security firm F12 said the incident was not caused by a smart contract vulnerability but by a flaw in the platform’s reward distribution mechanism. F12 said the attacker used an Aave V3 flash loan to borrow 427.5 WETH and exploited how NovaBox distributed dividends before updating user balances during deposits and withdrawals.
F12 said the attacker first deposited a small amount of NOVA tokens to trigger dividend calculations, then deposited a large amount of ETH to sharply increase their effective share. Because the system did not update the balance in time, dividends were calculated based on the earlier small share but paid out based on the new larger share, creating about 145.82 ETH in what F12 described as “phantom dividends,” which depleted the reward pool.
NovaBox Reward Pool Drained for 56.73 ETH in Ethereum Attack, F12 Says
2026-06-11 01:14:35
Disclaimer:
1. The information provided does not constitute investment advice. Investors should make independent decisions and bear all risks themselves.
2. The copyright of this content belongs to the original author. The views expressed herein are solely those of the author and do not represent the stance or position of this website.
Previous article：
NovaBox奖励池6月9日遭攻击损失56.73 ETH
