Blockaid flags Flamincome VaultYUSDT share-price exploit netting $345.9K
By 8bitcrypto
September 17, 2026
On September 16, security firm Blockaid flagged an exploit against older Flamincome contracts tied to Flamingo Finance: an attacker used roughly an $18 million USDT flash loan—reported via Morpho—to inflate VaultYUSDT share pricing, then redeemed liquid aUSDT for about $345,900 in profit. For Rug Room readers who already saw 8bitcrypto’s rsETH/Yoink Safe-module file, this is a smaller but cleaner share-price inflation case on legacy vault accounting—not a new NFT rug mint.
The Crypto Times and CoinEdition both cite Blockaid’s public thread: stake Curve USDP LP into a Strategy, push VaultYUSDT’s reported share price higher, redeem against real Aave aUSDT liquidity. Victim/strategy addresses circulating in desk coverage include 0xb8d6471cA573C92c7096Ab8600347F6a9Fe268a5 and related Flamincome contracts; attribute those hashes to the security disclosures, not to independent 8bitcrypto tracing.
SlowMist’s TI alert, carried by AiCoin’s flash desk, sharpens the root cause: the Strategy treated a permissionlessly injectable Convex BaseRewardPool balance as its own assets and valued injected USDP/3CRV LP with Curve get_virtual_price(), which overstated value in a depegged pool. That inflated share price was then redeemed against genuine aUSDT. Attacker address cited: 0x83381e7f7232775735169d72d237b858ffc36871. Flawed implementation hash also circulated as 0xff20De3F3F4C7E9518035a968B4A3CEE500a2AFB.
On-chain color around the attacker wallet shows classic pre-funding hygiene: about 0.1 ETH from Tornado Cash roughly two hours before the cluster, then a burst of ops including a 144.15 ETH transfer, a LI.FI Diamond interaction, USDT approval, and contract creation—per Crypto Times’ Etherscan read of Blockaid-linked addresses. Treat Tornado funding as attribution color from secondary desks, not a courtroom conclusion.
Flamingo Finance had not publicly responded to Crypto Times’ request for comment at that outlet’s publication time. The contracts were described as older Flamincome deployments—important for collectors who still leave allowance or vault exposure on forgotten yield wrappers. Legacy code paths remain a Rug Room constant even when headline brands look quiet.
Context from the same security week: the $7.8 million rsETH Safe-module attempt intercepted by Yoink (already logged by 8bitcrypto), Chainflip’s Tron USDT drain of about 736,442 USDT, and Zentra’s roughly $143,000 ctUSD incident. Flamincome’s ~$346K print is smaller dollar-wise but pedagogically sharp: share-price inflation via injectable pool balances plus depegged virtual-price oracles.
For NFT collectors, the Rug Room takeaway is operational, not aesthetic. Yield wrappers, strategy vaults, and leftover approvals on “old” Flamincome-style contracts can still siphon bid currency even when your PFP sits idle on OpenSea. Revoke unused approvals, avoid treating virtual prices from depegged Curve pools as hard NAV, and assume permissionless staking hooks can become attacker-controlled balance sheets unless the strategy accounting walls them off.
The Rug Room pattern across these incidents is permissions plus pricing assumptions. Whether it is a public keeper multicall on a custom Uniswap v4 module, a Tron settlement path left hotter than the rest of a bridge, or a strategy that treats injectable Convex balances as owned NAV, attackers still win by making the protocol believe a number it should not trust. Flamincome’s ~$346K is a textbook of that belief failure: virtual price in a depegged pool became the share-price oracle, then real aUSDT paid the bill.
What Thursday’s file proves is narrow. Blockaid/SlowMist desks report ~$345.9K extracted from legacy Flamincome VaultYUSDT share-price inflation via an ~$18M USDT flash loan. What it does not prove is that every Flamingo-branded product is compromised today, or that NFT floors will reprice on this alone. Confirm live contract status and your own approvals before treating any related vault as safe.
For 8bitcrypto readers on September 17, the clean Rug Room line is old Flamincome accounting meeting a flash loan—share price lied, aUSDT left, and another reminder that forgotten DeFi wrappers still hunt NFT wallets’ cash.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).