Back Mexc

Purrlend Exploit: DeFi Lender Loses $1.5 Million in Coordinated Dual

Mexc • April 25, 2026

Purrlend, a decentralized lending and borrowing protocol built on HyperEVM, suffered a suspected exploit on April 25, 2026.

The attack hit two separate networks simultaneously, HyperEVM and MegaETH. Combined losses reached approximately $1.5 million.

The incident was first flagged by Kirby Ong, founder of HypurrCollective. Purrlend has since paused all protocol operations while its team investigates the breach.

The exploit targeted Purrlend on both HyperEVM and MegaETH in a coordinated dual-network attack. HyperEVM suffered the larger of losses, with roughly $1.2 million drained from the protocol. MegaETH accounted for the remaining $324,549 in stolen funds.

Kirby Ong, founder of HypurrCollective, was the first to raise the alarm on social media. He posted a detailed breakdown of stolen assets across both chains. His post read: “Purrlend appears to be exploited on both MegaETH and HyperEVM.”

The stolen assets on HyperEVM included nearly $450,000 in USDC and $214,000 in USDT0. The attacker also took close to $195,000 in USDH, along with wstHYPE, kHYPE, WHYPE, and UETH tokens. On MegaETH, the attacker withdrew $163,000 in USDT0, WETH, and USDm.

Purrlend confirmed the incident shortly after through an official post. The team stated: “We have detected irregular activity on the protocol and are actively investigating.” The protocol remains paused as the investigation continues.

The Purrlend exploit adds to a growing list of attacks recorded in April. More than $600 million has been stolen from crypto protocols in just 18 days this month. That figure places April on pace to surpass even the most damaging months in recent DeFi history.

The bulk of April’s losses trace back to attacks on KelpDAO and Drift Protocol. Together, those two incidents account for an estimated $577 million in losses. Both attacks have drawn sharp attention to the state of security across DeFi platforms.

For Purrlend, the road to recovery will depend heavily on the findings of its ongoing investigation. The protocol has not yet disclosed the specific attack vector used by the exploiter. Until then, users have been urged to proceed with caution across all connected platforms.

Source:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Purrlend Exploit: $1.5 Million Lost in Dual-Network Attack On April 25, 2026, the decentralized lending protocol Purrlend experienced a coordinated exploit affecting both HyperEVM and MegaETH networks, resulting in losses estimated at $1.5 million. The attack was first reported by Kirby Ong, founder of HypurrCollective, who noted suspicious activity in the protocol's contracts. Approximately $1.2 million was drained from HyperEVM, while MegaETH suffered losses of around $325,000. The stolen assets included significant amounts of USDC, USDT0, USDH, and various ecosystem tokens. Following the incident, Purrlend has paused all operations to investigate the breach. This incident is part of a troubling trend in April 2026, where over $600 million has been stolen from various DeFi protocols, raising concerns about security standards in the sector. The specific attack vector used in this exploit has not yet been disclosed, and users are advised to exercise caution across all connected platforms. 3 sources 65

Extracted Entities

Purrlend Exploit: DeFi Lender Loses $1.5 Million in Coordinated Dual

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (4)