Pool Party snapshot contract flaw exploited to drain 15 pools on Arbitrum and Base for about $215k

Summary

Pool Party reported that on 13 November 2026, between 01:34 and 03:38 UTC, an attacker drained 15 pools: 12 on Arbitrum and 3 on Base, for a total loss of approximately $215k. Each pool has a snapshot contract that records each user's position; the attacker found a vulnerability in this contract, changed their recorded position, deposited 10 USDC and withdrew all funds from the pool. Pools on Polygon and Robinhood Chain were not affected.

Affected

• Pool Party pools and their snapshot contracts on Arbitrum (12 pools) and Base (3 pools)
• Fixed: per Pool Party, the snapshot contract vulnerability has been corrected on all 4 chains (Arbitrum, Base, Polygon, Robinhood Chain)

Impact

Exploitation is confirmed. Per Pool Party, the attacker has already converted the funds to XMR. Pool Party is tracking the funds with security teams and has reported the incident to law enforcement and the exchanges involved. A full post-mortem and a plan for affected users have been promised but not yet published.

Recommended actions

• Pool Party depositors: follow Pool Party's official X account and Discord for the post-mortem and the affected-user plan; ignore unofficial "refund" or "claim" links and DMs.
• Exchanges and wallets: screen for the attacker address listed in the indicators.
• Developers of similar vault/fund contracts: review any contract that records user positions for unauthorized write paths.

Source & attribution

This 0xCERT advisory summarises Pool Party's incident thread (https://x.com/PoolParty_xyz/status/2121307902430359906), corroborated by SlowMist Hacked (https://hacked.slowmist.io/). The attacker address is quoted verbatim from Pool Party's thread. Details may change; refer to the original source for the authoritative record.