Despite a detailed breakdown, Slowmist did not name the attacker or say whether the stolen funds could be recovered anytime soon.
In the DIP case, the missing “return” meant code that should have stopped after one transfer instead fell through and executed a second time. Each trade that touched the router effectively paid out twice, quietly bleeding USDC from the pool.
Part of a Costly 2026 for DeFiThe DIP loss is small next to the year’s headline breaches, but it fits a steady drumbeat of code-level failures. Slowmist’s public hack database alone has logged more than 2,150 incidents and about $37.8 billion in cumulative losses. In recent days, the tracker recorded a $105,000 loss at Thetanuts Finance and a $2.1 million Aztec Connect exploit.
