An attacker drained roughly $1.73 million in DAI and USDC from Notional Finance's legacy V1 escrow contract in two transactions, three minutes apart — 11:58 p.m. UTC on September 3 to 12:01 a.m. UTC on September 4, 2026. By the next morning, the stablecoins were gone: swapped to ETH and sitting in Tornado Cash. Here's how it happened, based on Merkle Science’s own on-chain reconstruction plus the open-source reporting that broke in the hours after.
The contract in question was part of Notional V1, the version of the protocol Notional wound down after its November 2025 exposure to the Balancer V2 exploit. The V1 escrow stayed live and still held real funds, just without the active monitoring a production contract gets.
The attack ran through two mintfCashPair() calls that summed to exactly 2^128. That overflowed an unchecked uint128 downcast in the contract's collateral-validation logic, truncating what should have been a massive negative liability down to zero. The fabricated fCash position sailed through a check that should have caught it, and the attacker walked away with 1,658,305.94 USDC and 69,257.3727 DAI, pulled straight out of the escrow contract at 0x9ab…7f683.
An on-chain security firm published a breakdown of the mechanism within hours, and a separate monitoring alert corroborated it independently. Notional itself has said nothing publicly: no statement, no confirmed loss figure, no post-mortem, as of this writing.
The two-transaction, three-minute timeline is worth sitting with. There was no scanning, no failed attempts, no on-chain trial and error visible beforehand. The attacker knew exactly which two calls to make and in what order, which points to prior code review of a contract most of the ecosystem had stopped paying attention to months ago.
Our graph traces the drained funds into two attacker-created contracts: 0x4a3…9caff took the USDC leg (1,658,305.94 USDC), 0x265…9c03c the DAI leg (69,257.3727 DAI). Both fed into a single consolidation wallet, 0xdac…5ce38, within minutes of the exploit.
From there, the attacker moved 0.07 ETH to one of their created contracts, 0xec4…90d78 — funds that may have then been forwarded to a block-building service, potentially in connection with private transaction routing designed to avoid exposure through the public mempool and reduce the likelihood of MEV bot interference. Separately, the consolidated DAI and USDC moved to another wallet controlled by the attacker, 0x8aa…e3be6, where the funds were swapped into 689.2126 ETH and forwarded to 0xc95…4de69, before being sent to Tornado Cash across approximately 25 separate transactions, with the funds split into smaller amounts in a manner that could make re-linking on the other side more difficult.
Before any of the exploit transactions were broadcast, the consolidation wallet 0xdac…5ce38 received 1.182 ETH from 0x2cf…02680, an address tagged to Near-intents.org, NEAR's cross-chain intents infrastructure. That's gas money (enough to cover the exploit call and the cleanup that followed), and it arrived through an intents pathway rather than a CEX withdrawal or a bridge. It's a funding pattern we've seen many times before, just one that hasn't come up in the public reporting on this particular case.
This doesn't tell us who the attacker is. It tells us how they funded the attack, and it's worth logging as a pattern: intents-based routing is a newer, less-watched on-ramp for attacker gas than the usual bridge-and-mixer combination.
Deprecated contracts that still hold funds are an easy target, not because the code is worse but because nobody's watching them the way they'd watch a live product while the money's still sitting there. And downcasting to fixed-width integers without bounds checks keeps showing up as a root cause years after it was supposed to be a solved problem; it resurfaces almost every time a contract predates the current generation of tooling and never gets re-audited against it.
For compliance and risk teams, the actionable part is narrow: flag inbound funds tied to the attacker-controlled cluster in this case (identified above) — 0x4a3…9caff, 0x265…9c03c, 0xdac…5ce38, 0xec4…90d78, 0x8aa…e3be6, and 0xc95…4de69 — before processing them further.
Legacy contracts are the recurring thread here. Every protocol that ships a V2 or a V3 leaves a V1 behind, and the assumption is usually that users migrated out, or that whatever's left isn't worth an attacker's time. Notional's V1 sat there for months after the Balancer incident forced the wind-down, funded and functional, while the team's attention moved elsewhere. That gap is where this happened, and it's rarely a one-off.
We'll update this post if Notional publishes an incident report or the funds move again.
Sources: BeInCrypto, crypto.news, CryptoAdventure, CoinoTag, CryptoTimes. Fund-flow reconstruction, full wallet attribution, the NEAR Intents funding link, and the Tornado Cash structuring pattern are Merkle Science's own on-chain investigation, graphed end-to-end from escrow to mixer — full unredacted addresses available on request under case ref Notional Finance V1 Exploit – 04-09-2026.
Want flows like this flagged before they hit a mixer? Book a walkthrough of Merkle Science Tracker.
