Notional Finance Exploit Suspected After $1.7M Swapped for 689.2 ETH

Security monitors reported that DAI and USDC linked to a Notional Finance escrow contract were converted into ETH. Meanwhile, the protocol had yet to confirm the incident.

A Notional Finance exploit is being investigated after blockchain security monitoring reports indicated that approximately $1.7 million in DAI and USDC was removed from an escrow contract associated with the DeFi protocol. The funds were later converted into about 689.2 ETH before being sent to Tornado Cash. The incident had not been independently confirmed by Notional Finance in the sources reviewed by MemeBlock.

The initial alerts were attributed to blockchain security monitoring from Specter and amplified by PeckShield-related reporting. Multiple independent news reports subsequently described the same basic sequence of events: stablecoins left a Notional-linked escrow or custody contract. Then, the assets were converted into Ether, and the resulting ETH was deposited into Tornado Cash.

However, important details remain unresolved, including the precise attack vector, the final loss amount, and the identities behind the wallets involved. In addition, it is unclear whether the full transaction path has been confirmed by the Notional team.

Security Monitors Report Roughly $1.7 Million in Stablecoin Losses

BloomingBit reported that approximately 69,257 DAI and 1,650,824 USDC left the address under scrutiny. This places the reported total near $1.728 million based on the nominal dollar values of the two stablecoins. The outlet said PeckShield, citing Specter analysis, had identified signs that Notional Finance’s escrow contract may have been attacked.

Other reports used rounded figures, describing the incident as a loss of approximately $1.7 million in DAI and USDC. Furthermore, BlockBeats similarly reported that Specter monitoring, cited through PeckShield, indicated that an escrow contract associated with the fixed-rate borrowing protocol had been attacked or exploited.

The wording is important. The available reports did not establish, through a public statement from Notional Finance, that the event had been conclusively classified as a smart-contract exploit.

At the time of review, reports continued to describe the event as a suspected attack or suspected exploit. The precise cause and final scale of losses remained pending.

Reported Funds Were Converted Into 689.2 ETH

According to the security-monitoring reports, the DAI and USDC were subsequently exchanged for approximately 689.2 ETH.

The ETH was then reportedly deposited into Tornado Cash, an Ethereum-based privacy protocol that can make the public tracing of subsequent fund movements more difficult. Meanwhile, multiple reports independently repeated this transaction sequence while attributing the underlying alert to PeckShield and Specter monitoring.

MemeBlock has not independently verified the complete transaction trail, wallet addresses or transaction hashes because those details were not consistently available in the primary reporting surfaced during this research.

For that reason, the movement should be described as a reported on-chain sequence rather than a fully independently reconstructed transaction trail.

That distinction is especially relevant in early-stage DeFi security incidents, where initial alerts can identify abnormal asset movements before a protocol determines whether those movements resulted from an external exploit, an administrative action, a vulnerability, or another event.

Notional Finance has Faced Security Incidents Before

The latest reported incident comes after previous security problems involving the Notional ecosystem.

In September 2022, Notional published a post-mortem stating that it had received a critical bug report involving a potential flash-loan attack vector. The protocol said it disabled the affected feature within two hours and estimated that approximately $5,000 in DAI and USDC had been withdrawn without collateral before a fix was deployed.

More recently, Notional published a detailed response to the 2025 Balancer V2 hack. The protocol stated that Notional V3 had been affected through its exposure to Balancer-linked leveraged vaults. Ultimately, the incident resulted in a full wind-down of Notional V3 after significant losses for affected users.

Those earlier incidents should not be treated as evidence that they share the same technical cause as the newly reported event. Furthermore, no verified source reviewed for this article established a connection between the current suspected exploit and either previous security incident.

Why the Reported Notional Finance Exploit Matters

The most significant immediate issue is the apparent speed of the reported asset movement.

If the reported sequence is confirmed, the stablecoins were converted into ETH and subsequently sent into a privacy protocol. This happened before a complete public explanation of the incident had emerged. That can complicate recovery efforts because investigators may face greater difficulty following the funds after they enter mixing infrastructure.

The case also illustrates a broader challenge for DeFi users and protocols. Initial information about security incidents often comes first from independent on-chain monitors rather than the affected project.

Security alerts can provide valuable early warnings, but early reports may contain incomplete wallet attribution, preliminary loss estimates or assumptions about the nature of an event. Meanwhile, a protocol’s subsequent technical investigation can materially change the understanding of what happened.

For users with exposure to Notional-related products or contracts, the key question is therefore not only the reported value of the assets moved. It is also whether other contracts, pools or user balances were affected.

The currently available reports do not provide a verified answer.

Key Questions Remain Unanswered

Several critical facts were still unavailable at the time of writing.

First, the exact smart contract involved requires direct verification through a blockchain explorer or an official technical disclosure.

Second, the reported sending and receiving wallet addresses, transaction hashes and timestamps need independent confirmation before they are published as definitive facts.

Third, Notional Finance had not provided a current official incident explanation in the sources reviewed for this article.

Finally, the reported approximately $1.7 million loss remains a preliminary estimate. BloomingBit cited more specific quantities of DAI and USDC totaling roughly $1.728 million at nominal stablecoin values. Several other reports rounded the figure to $1.7 million.

What Happens Next

The next developments to monitor are an official statement from Notional Finance, confirmation of the affected contract, and a technical explanation of how the reported asset movements occurred.

Editors should also watch for independently verifiable blockchain records from Etherscan or another Ethereum explorer. Updates from established blockchain security firms can provide the complete transaction trail and wallet attribution.

Until those details are available, the most defensible description is that security monitors reported a suspected incident involving a Notional Finance-related escrow contract. This was followed by the reported conversion of approximately $1.7 million in DAI and USDC into 689.2 ETH and a subsequent transfer into Tornado Cash.