Notional Finance Escrow Contract Drained for About $1.7M in Stablecoins

A security analysis published by QuillAudits says a Notional Finance escrow contract was drained for roughly $1.73 million in DAI and USDC, with the funds later routed through a series of on-chain transfers and sent to Tornado Cash.

The report describes the incident as an exploit involving Notional Finance’s V1 Escrow contract. According to the analysis, about 69,257.38 DAI and 1,658,524.864122 USDC were withdrawn and then moved onward, with the stablecoins later converted into ETH before reaching the mixer.

On-chain transfers point to a narrow window

The analysis says the drain took place in a short time window after a setup transaction from the attacker address, followed by the main withdrawal transaction a few minutes later. It also says the ETH obtained from the stablecoins was later deposited into Tornado Cash in multiple chunks.

PeckShieldAlert separately said Specter reported that the Notional Finance escrow contract “may have been exploited.” That alert put the reported loss at approximately $1.7 million based on prices at the time and said the funds were subsequently swapped into about 689.2 ETH.

At the time of the report, Notional Finance had not posted an official statement, and the available material did not independently confirm the identity of the party behind the transactions.

The incident adds to a run of DeFi security events in which on-chain transfers can move quickly from stablecoins into ETH and then into a mixer, making follow-up tracing more difficult even when the initial movement is visible on-chain.