Back Bitget

Purrlend: Security incident caused by administrator multisig breach, resulting in a loss of ...

Bitget • May 1, 2026

ChainCatcher reports that Purrlend stated it experienced a security incident during deployment on HyperEVM and MegaETH, resulting in a loss of approximately 1.52 million US dollars.

The attacker breached the team's 2-out-of-3 admin multisig wallet, granted BRIDGE_ROLE and other privileges to a malicious EOA, and used mintUnbacked to mint unbacked pUSDm and pUSDC, which were used as collateral to borrow assets from the pool. Purrlend stated that the protocol has been paused, relevant permissions revoked, and it is currently working with the security team, law enforcement agencies, and cross-chain bridge partners to trace and attempt to recover the funds.

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

Dan Bin's Fund Increases Holdings in Circle by Over 30,000 Shares, Valued at Over $3 Million

Impacted by the Iran war, UK factories face increased costs and intensified delivery delays

The total US stock market capitalization surpasses $75 trillion, hitting a record high.

trade.xyz changes its internal pricing mechanism to the weighted moving average within 30 minutes

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Purrlend Faces $1.52M Loss from Multi-Signature Wallet Breach Purrlend reported a security incident during the deployment of HyperEVM and MegaETH, leading to a loss of approximately $1.52 million. The breach occurred when an attacker compromised the team's 2-out-of-3 multi-signature wallet, granting a malicious externally owned account (EOA) permissions such as BRIDGE_ROLE. The attacker minted unbacked pUSDm and pUSDC through the mintUnbacked function, using these tokens as collateral to borrow assets from the liquidity pool. In response, Purrlend has paused the protocol, revoked related permissions, and is collaborating with security teams, law enforcement, and cross-chain bridge partners to trace and recover the stolen funds. The incident highlights vulnerabilities in multi-signature wallet management and the importance of robust security practices in DeFi protocols. 2 sources 65

Extracted Entities

Purrlend: Security incident caused by administrator multisig breach, resulting in a loss of ...

The full story

Extracted Entities

Attack Types (1)

Companies (3)

Countries (1)

CWE Weaknesses (1)

Domains (1)