Haedal Protocol Hack Report (June 9, 2026)
@HaedalProtocol, a liquid staking protocol on Sui, suffered a smart contract exploit in its haeVault pools, resulting in approximately $915,000 in losses.
The Flaw
The root cause was a hidden cross-version logic vulnerability introduced during a Vault contract upgrade at the end of 2025.
Older package entrypoints were not fully deprecated, creating an inconsistency between contract versions.
Attackers exploited the old deposit paths to mint inflated LP shares and redeemed them through new paths to drain excess assets.
This upgrade compatibility issue evaded isolated audits.
Response & Refunds
The team promptly detected the issue, paused affected contracts, and contained further damage.
Haedal has committed to fully refunding all affected users for their direct losses. A patched upgrade is in development and will undergo re-audit before deployment. Other protocol modules and assets remain unaffected.
Users will be made whole. Official post-mortem and recovery details are available on Haedal’s channels.
Thanks to the team of
@HaedalProtocol that addressed the issue and responded positively.
It's a tough time for DeFi protocols but the otters are holding up.
📢 Thank you for your patience.
We have completed the Haedal Vault post-mortem report, covering the affected scope, root cause, loss accounting, and current next steps. The total direct loss is estimated at approximately $915,179 (Haedal will cover the user loss).
On June 9, we detected abnormal liquidity decline across several Vault pools. To prevent further abnormal activity, we paused the related contracts while investigating the issue.
After a thorough diagnosis, we confirmed that the root cause was a hidden cross-version logic issue related to a Vault upgrade deployed at the end of last year. After the newer Vault package was released, older package entrypoints remained callable instead of being fully deprecated through a forced upgrade. This allowed the attacker to mint more Vault LP shares than expected through an older deposit path, then redeem them against the Vault’s underlying assets.
The old package, new package, and upgrade had all gone through audit review, and the issue did not surface when each version was reviewed independently. In hindsight, the update should have been treated as a forced upgrade, as keeping older entrypoints callable allowed the hidden cross-version logic loophole to appear.
To clarify, the issue was only limited to Haedal Vault. All other Haedal products, modules, and assets remain fully safe and unaffected.
We are now working on a patched version, which will go through re-audit and cross-party review before the upgrade and unpause. We are also coordinating with partners on fund tracking and the investigation against the exploiter.
As previously stated, all direct losses regarding this incident will be covered by Haedal, and affected users will be made whole. Please rest assured. A detailed fund recovery plan will be shared later once the short-term barriers are cleared.
We sincerely apologize for the inconvenience and concern caused. Thank you again for your continued patience while we complete the next steps carefully. 🫡