Question 1

How much was stolen in the Huma Finance exploit?

Accepted Answer

Approximately $101,400 in USDC and USDC.e got drained from Huma Finance's deprecated V1 BaseCreditPool contracts on Polygon on May 11, 2026. Blockaid and Huma Finance both confirmed the amount.

Question 2

Are Huma Finance user funds safe?

Accepted Answer

Huma Finance stated that no user funds are at risk. Its current V2 system on Solana is a complete rewrite. The V1 vulnerability doesn't touch it.

Question 3

What caused the vulnerability?

Accepted Answer

A logic flaw in the `refreshAccount()` function within the V1 BaseCreditPool contracts improperly upgraded an account's status without adequate validation. That let the attacker bypass authorization checks and withdraw funds, according to Blockaid and The Crypto Times.

Huma Finance

Huma Finance loses $101K in Polygon exploit on same day as Ink breach

One sharp brief.
Every day.

Huma Finance

Huma Finance loses $101K in Polygon exploit on same day as Ink breach

One sharp brief.Every day.

One sharp brief.
Every day.