Pool Party reports roughly $215,000 lost from 15 pools on Arbitrum and Base
Pool Party says an attacker manipulated recorded positions in pool snapshot contracts and drained 12 Arbitrum pools and three Base pools. The team estimates losses of $215,000 and says it deployed a fix on the four chains named in its announcement.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Liquidity providers in the affected Pool Party pools on Arbitrum and Base.
- DeFi · Smart contract · Arbitrum · Base
- In the wild
- Yes
- Pool Party reports exploitation of its snapshot contract across 15 pools.
What happened
Pool Party says a flaw in the snapshot contract that records user positions let an attacker alter their recorded position. The team describes a 10 USDC deposit followed by withdrawal of the pool’s funds. It reports no losses on Polygon or Robinhood Chain and says the snapshot fix is live on all four chains. The statement provides no deployment transactions or independent verification.
The team identified 0x2075c17abbd077cf6406736bb7047ed446ab7f8f as the attacker address and says it traced the funds to a conversion to XMR and reported the incident to law enforcement and exchanges. An address match alone does not establish ownership or compromise. The announced loss is an estimate. The team has yet to disclose completed recovery or compensation.
An Arbitrum transaction carries an offer signed by the Pool Party team. It asks the recipient to return about $193,500 within 24 hours and offers to let them retain 10%. The transaction records the offer. Recovery remains unverified.
Crime-scene timeline
Nov 13, 01:34–03:38 UTC
Attacker drains 15 pools
The team reports unauthorized withdrawals from 12 pools on Arbitrum and three on Base.
Nov 13, 18:13:22 UTC
An on-chain message signed Pool Party offers a bounty
The message on Arbitrum offers 10% and asks the recipient to return the remaining amount, about $193,500, within 24 hours.
Nov 13, 18:23 UTC
Pool Party discloses the incident
The initial post estimates losses at $215,000. Follow-up posts in the same thread describe the snapshot flaw and report a fix on Arbitrum, Base, Polygon and Robinhood Chain.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Pool Party incident threadOriginal team statement on the attack, loss estimate, response and announced fix. Direct access returned HTTP 403.
- Public archive of the Pool Party team's threadPrimaryReadable copy of the original statement and the team’s follow-up posts.
- Arbitrum transaction carrying the bounty offerPrimaryRecords the send time, recipient and return offer signed Pool Party team.