DefiTuna Incident Analysis

On 16 July 2026 attackers exploited DeFiTuna on Solana to withdraw $569,601 USDC by creating a highly illiquid TUNA/USDC pool and routing borrowed USDC through it; the swap output was so small that the protocol's fixed-point-to-integer conversion rounded the asset value to zero, bypassing the solvency check and allowing withdrawals to attacker-controlled limit-order positions. The report includes attacker addresses, transaction decoding, the vulnerable code path (compute_total_and_debt/is_healthy), and post-exploit fund flows including bridging to Ethereum and deposits into privacy services.