Reentrancy attacks on Ethereum

~$27M drained from Penpie after a reentrancy gap in Pendle's plugin integration let the attacker register a malicious market and pull pegged rewards in one tx.

An attacker exploited rate-provider read-only reentrancy in Balancer boosted pools after a disclosure, draining ~$2.1M before users could fully exit liquidity.

Conic Finance's ETH Omnipool had reentrancy guards but assumed Curve v2 used a specific ETH address. A new CurveLPOracleV2 slipped past it, draining $3.2M.

$800K drained from Sturdy Finance via a Balancer read-only reentrancy that mispriced B-stETH-STABLE LP collateral. Funds returned after negotiation.

$3M drained from Orion on Ethereum and BSC after doSwapThroughOrionPool accepted unvalidated paths with no reentrancy guard; a fake token inflated balances.

Reentrancy on exitMarket() drained $80M from Rari Capital's Fuse lending pools, a function the team forgot to protect when patching reentrancy the prior month.

$2M drained from Revest Finance via a reentrancy in mintAddressLock/depositAdditionalToFNFT that let the attacker mint over-valued NFTs and redeem them.

Visor Finance's staking contract lost $8.2M to a reentrancy in the delegateTransferERC20 path. VISR fell 95% same-day; Visor migrated to a new token.

$18.8M drained from Cream Finance v1 lending markets via a reentrancy bug in the AMP token's ERC-777 transfer hook — the second of Cream's three 2021 exploits.

2,600 ETH ($10M, 60% of pool) drained from Rari's Ethereum Pool after its Alpha Finance ibETH integration allowed arbitrary external calls enabling reentrancy.

$7.7M drained from the OUSD stablecoin vault two months after launch via a fake-stablecoin reentrancy bug introduced when a gas-saving refactor dropped a check.

A fake ERC-20 with a reentrant transferFrom let an attacker re-enter Akropolis's deposit flow and mint $2M in pool shares without delivering real collateral.

The DAO lost 3.6M ETH ($50M) to the textbook reentrancy bug, the heist that split Ethereum into ETH and Ethereum Classic and rewrote smart-contract development.