Cryptorank RetoSwap Monero DEX Hack Results in $2.7 Million Theft
Article Content
- •7,000 XMR, worth $2.7 million, was stolen from RetoSwap due to a smart contract vulnerability.
- •The attacker has not attempted to launder the stolen funds through known mixing services.
- •The incident has prompted concerns about security in the Monero DeFi ecosystem and calls for improved audits.
RetoSwap, a decentralized exchange on the Monero blockchain, was exploited, leading to the theft of approximately 7,000 XMR, valued at around $2.7 million. The breach was first identified by PeckShield, which reported a vulnerability in RetoSwap's smart contract infrastructure. The specific method of attack has not been disclosed, but it could involve flash loans or price oracle manipulation. The stolen funds have been transferred to a separate wallet, with no laundering activity detected through known mixers. This incident has caused a minor dip in XMR's price by about 1.5%, raising concerns within the Monero community about the security of DeFi platforms. RetoSwap has not yet issued a post-mortem or announced any plans for user reimbursement, leaving affected users uncertain about their funds. The incident reflects ongoing security challenges in decentralized finance, especially for smaller exchanges.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track RetoSwap in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…