Nad.fun security review: Legacy Token Graduation Flow Breach and Losses
In short
Attackers drained 1.716M WMON from Nad.fun's legacy V1 bonding curve in late October 2026 using a graduation trick on shared reserves.
Nad.fun security review shows that the platform suffered a targeted exploit in its legacy V1 token graduation flow between October 28 and 29, 2026. Attackers drained roughly 1.716 million WMON, valued at about $36,400 at the time. V2 tokens and already-graduated V1 tokens remained unaffected.
Platform Overview and Version Differences
Nad.fun launched its mainnet on the Monad blockchain around November 2025 after raising $1.1 million in seed funding. The service operates as a token launchpad that uses bonding curves to facilitate memecoin and token deployments. It maintains both a legacy V1 system and an updated V2 system.
The V1 version relied on a shared BondingCurve contract and Capricorn CL pools. V2 introduced a unified router, separate TokenRegistry, individual vaults, anti-sniping measures, and support for flexible quote assets. Prior audits by Zenith and Beosin identified and addressed low-severity findings in V1. CertiK assigned an early-stage BBB rating. Total value locked stood near $361,000 before the incident, with most activity shifting to V2 afterward.
| Feature | V1 | V2 |
|---|---|---|
| Curve architecture | Shared BondingCurve | Separate vaults |
| Router | Basic | Unified router |
| Security additions | None listed | Anti-sniping, TokenRegistry |
| Affected by incident | Yes | No |
Timeline and Mechanics of the Graduation Flow Attack
The first attack occurred on October 28 at approximately 19:25 UTC and removed about 110,500 WMON. The second attack followed on October 29 between 10:09 and 10:16 UTC, draining an additional 1.606 million WMON across 59 transactions. Attackers used large purchases to trigger graduation of V1 tokens, then performed swaps that extracted excess WMON from the shared curve reserves beyond the amounts deposited.
Nad.fun published a security update on October 29 at 15:58 UTC confirming the issue and stating that the vulnerable path had been blocked. The attackers bridged roughly 1.204 million MON, valued near $25,500, through the Relay service. V2 tokens and pre-incident graduated V1 tokens stayed secure because they did not rely on the shared legacy curve.
Losses, Response, and Recommendations for Users
Curve reserves fell from roughly 3.48 million WMON to 1.87 million WMON after the combined drains. Approximately 512,000 WMON remain unaccounted for in public reports and may cover fees or pool remnants. The platform stated it is tracing transactions, assessing impact, and preparing a compensation plan through official channels only.
Users should avoid unofficial links claiming to handle compensation. V2 remains the active deployment path while the investigation continues. A full post-mortem on root causes and mitigations has not yet been released as of October 30, 2026. Platform TVL and activity data can be monitored on DefiLlama for ongoing verification.
Frequently asked questions
Is Nad.fun safe after the October 2026 incident?
V2 tokens and graduated V1 tokens were not affected by the exploit. The platform blocked the vulnerable path and stated that work continues on fixes and compensation. Users should monitor official announcements for updates.
What caused the Nad.fun breach?
Attackers exploited a flaw in the legacy V1 graduation flow that allowed excess WMON to be drained from shared curve reserves after triggering graduation. The method involved coordinated large buys and subsequent swaps.
How much was lost in the Nad.fun incident?
The V1 curve lost approximately 1.716 million WMON, equivalent to about $36,400 at prevailing prices. Attackers successfully bridged a portion of the funds off-chain.
Will Nad.fun compensate affected users?
The team has committed to a compensation plan and warned users to use only official channels. Details on eligibility and timing remain pending the full post-mortem.
TrustScope
Comments
No comments yet. Be the first!