Hacker Mints $27M in Tokens but Escapes With Just $132K From Meta Pool

Key Insights:

• Hacker exploited Meta Pool’s fast unstake function.
• Only $132K stolen despite $27M minted.
• Liquidity and fast response limited losses.

A hacker exploited Meta Pool’s smart contract to mint $27M in tokens but walked away with only $132K. Liquidity issues and swift action by the team limited further damage. A full post-mortem is expected soon.

Flash Exploit Ends in Low Yield as Meta Pool Escapes Major Loss

A hacker managed to exploit a vulnerability in Meta Pool’s smart contract to mint nearly $27 million worth of mpETH tokens. However, the attempt to drain funds largely failed, with only around $132,000 in Ether ultimately stolen.

The incident, disclosed by Meta Pool on June 18, involved a targeted attack on the protocol’s “fast unstake” functionality. The attacker exploited a bug in the ERC4626 mint() function, allowing unauthorized token creation. Despite the large mint, market conditions and internal controls restricted the impact.

“Early detection systems helped pause the affected contract,” Meta Pool said in a blog post.

Blockchain security firm PeckShield identified the vulnerability as a critical flaw in the minting mechanism. It confirmed that the exploit allowed the attacker to create mpETH “for free,” but added that low liquidity severely limited potential profit.

Liquidity and Smart Response Block Broader Damage

The attacker successfully minted 9,705 mpETH, a figure Meta Pool said carried a theoretical value close to $27 million. However, only 52.5 Ether—worth just over $132,000—was withdrawn from swap pools before the exploit path was blocked.

Several Ethereum mainnet and Optimism-based pools were affected, but low trading volumes and liquidity in the exploited contracts restricted further drain.

“Low liquidity of mpETH limited the profit,” PeckShield posted on X.

Meta Pool co-founder Claudio Cossio confirmed the use of a flash unstaking bug to mint the tokens. In a post on X, he noted that the flaw bypassed the usual waiting period required after unstaking.

Normally, unstaked crypto assets remain locked for a period before they become available. Fast unstaking, or “flash unstaking,” is designed to offer immediate access under specific constraints. In this case, that mechanism opened a pathway for abuse.

Swap Pools Targeted, Ethereum Stakes Unaffected

The hacker used the newly minted mpETH to drain select swap pools across Ethereum and Optimism. However, Meta Pool clarified that the core Ethereum staking assets remained untouched.

“All Ethereum staked is safe,” the team said, adding that validator nodes under the SSV Network continue to generate rewards.

The company reassured users that only swap liquidity was affected. The broader staking infrastructure and user-delegated ETH remained secure throughout the incident.

A full post-mortem is now underway. Meta Pool plans to release a comprehensive breakdown within two days and implement a recovery plan. The exploited contract will remain paused during the investigation.

Meta Pool stated its intention to “reimburse the assets lost by this incident” and ensure users are “made whole.” That includes a full audit of affected contracts and enhanced monitoring protocols to prevent future incidents.

Broader Pattern of Smart Contract Exploits in 2025

The Meta Pool incident adds to a growing list of crypto protocol attacks in 2025. Blockchain protocols have faced sustained threats, particularly through flawed contract logic.

On June 6, Bitcoin-based DeFi platform Alex Protocol lost $8.3 million after a vulnerability in its self-listing verification logic allowed a bad actor to drain asset pools.

Earlier this month, Taiwan-based crypto exchange BitoPro confirmed a separate incident that resulted in $11.5 million in losses from its hot wallets. The breach occurred on May 8 but only became public on June 2.

So far in 2025, hackers have stolen more than $2.1 billion across various crypto platforms, according to data from CertiK.

Smart contracts remain a critical attack surface. The shift in hacker tactics has increasingly moved away from brute force to exploiting edge cases and faulty assumptions in contract architecture.

Recovery and Future Safeguards

Meta Pool now faces the task of rebuilding user confidence. The quick freeze of the exploited contract and limited damage will likely ease concerns among stakeholders. However, the team must now navigate the post-attack landscape with transparency.

With over 52.5 ETH lost and $27 million in tokens briefly minted under malicious control, the incident highlights the importance of rigorous code audits and real-time monitoring.

The company said its early detection system “successfully flagged the anomaly,” helping engineers react swiftly. That response likely prevented the attack from escalating into a broader liquidation event.

A full audit and updated safeguards are expected to follow. Meanwhile, the paused mpETH contract remains under review as Meta Pool works to ensure long-term user protection.

Disclaimer

This article is for informational purposes only and provides no financial, investment, or other advice. The author or any people mentioned in this article are not responsible for any financial loss that may occur from investing in or trading. Please do your research before making any financial decisions.