On October 9, 2026, blockchain security firm SlowMist flagged two separate decentralized finance (DeFi) incidents involving the protocols BitBay and EtherVista. Attackers exploited unrelated smart contract flaws to drain a combined total of approximately $32,600. The first incident occurred at 03:28 UTC, targeting BitBay’s DAI/USDC vault on the Polygon network. The second alert was issued at 05:20 UTC for EtherVista, a decentralized exchange protocol. In both cases, the code erroneously paid out more tokens than the attacker owned due to logic failures in withdrawal functions and safety checks.
The BitBay loss amounted to roughly 14,838.47 DAI, valued at $14,000 by SlowMist’s database. The vulnerability lay in the _withdraw() function, which transferred the entire token balance when liquidity stood at zero. An attacker forced this condition via the reposition() function before redeeming a minimal share unit. The EtherVista incident resulted in an estimated $18,600 loss in Wrapped Ether and VISTA tokens. This stemmed from an integer overflow in the K-invariant check within the swap() function. By registering a malicious router contract, the attacker executed crafted swaps that bypassed the constant product rule, allowing them to withdraw value exceeding their deposits.
These incidents highlight persistent risks associated with edge-case handling in smart contract logic, specifically regarding zero-liquidity states and integer overflows. While the financial impact is minor compared to recent large-scale breaches like the Bitget hack, the attacks demonstrate how fundamental arithmetic and state-management errors can compromise asset custody. The exploitation of the BitBay vault underscores the danger of assuming proportional payouts without verifying actual ownership shares during extreme liquidity conditions. Similarly, the EtherVista breach reveals the fragility of invariant checks when data types have limited bit-widths, allowing calculations to wrap around and falsely validate unauthorized trades.
From a market structure perspective, these events reinforce the necessity for rigorous formal verification and fuzz testing beyond standard audits. The lack of official statements from either protocol regarding fund recovery or user compensation introduces operational uncertainty for affected users. As DeFi infrastructure matures, the industry must address not only high-value targets but also smaller pools where basic coding oversights remain prevalent. Monitoring whether these protocols implement immediate patches or if similar vulnerabilities persist in other contracts using identical logic patterns will be critical for assessing broader systemic resilience.