A flash loan attacker drained 9.25 ETH from Ethereum's RedSonic Vault in a single, self-contained transaction. Blockchain security firm ExVulSec identified the exploit and published a full technical breakdown of the incident, which occurred on September 5, 2026.

The attacker required no upfront capital of their own. Instead, they flash-borrowed 1,139 WETH from Balancer to fund the entire operation. Flash loans allow borrowers to access large sums without posting collateral, provided the loan is repaid within the same transaction — a mechanism attackers frequently use to fund exploits that would otherwise demand substantial starting capital.

How the Exploit Unfolded

The root of the attack lay in how RedSonic's vault prices its rsvETH shares. The vault calculates share value through a function called getTotalAssetBalance, which, for the Lido position, reads the vault's raw stETH balance directly. This design choice became the foundation of the exploit: share prices tied directly to a raw balance can shift if that balance changes unexpectedly, with no corresponding shares needing to be minted or burned. Pricing share value off raw token balances rather than a manipulation-resistant accounting method is a recurring weakness across DeFi exploits, and this incident fits that broader pattern.

According to ExVulSec, the vault's registerErc20 function carried no access restrictions, meaning anyone could register a new asset class inside the vault. Unrestricted administrative functions are among the most commonly cited root causes in post-mortem reports from security firms. The attacker registered stETH as a second asset, creating a share class called rsvstETH. Both share types then drew from the exact same underlying stETH balance.

The exploit contract self-destructed once execution finished. Security researchers note that self-destructing contracts often complicate later on-chain tracing efforts. ExVulSec also confirmed the exploit ran inside the contract's constructor.

ALERT — Exploit on Ethereum @reddio_com RedSonic Vault was drained for ~9.25 ETH. A no-capital attacker flash-loaned 1,139 WETH from Balancer, inflated the vault's share price, and cashed out. The exploit ran inside a self-destructing contract's constructor. Root cause: the… — ExVul (@exvulsec), September 5, 2026

The Dual-Asset Flaw

The attacker first deposited 1,130 ETH, acquiring close to 99% of all outstanding rsvETH shares — a position that set up the rest of the exploit. Next, they deposited 9.34 stETH directly into the vault. That single deposit inflated the stETH balance without minting any new rsvETH shares.

Because rsvETH pricing reads the raw stETH balance, the extra deposit artificially pushed the share price higher. The attacker's existing rsvETH holdings instantly gained value as a result, without any new rsvETH being issued.

The attacker then redeemed their rsvETH for 1,139.5 ETH, according to ExVulSec's transaction analysis — a redemption that produced the full 9.25 ETH profit. They also separately redeemed the rsvstETH shares for stETH. The identical underlying collateral effectively paid out twice from one shared, pooled vault balance.

ExVulSec reported that the recovered stETH was swapped for ETH on Curve, and the Balancer flash loan was repaid within the same transaction.

On-Chain Details

Etherscan data lists the attacker's wallet as 0x70f2333d21Ed7E7D105F6578227A9A747687982C. The RedSonic Vault contract sits at 0x4315990d9eeaffdfafd49958b4851f203fa1126f, and the attack transaction carries the hash 0xe3cba90e865c6cba950ebce36a52607f51f1fd33cd9fb920c78803f19b57791a. The transaction remains publicly viewable on Etherscan for anyone wishing to verify the exploit's details. Because the full attack, including registration of the second asset class, executed atomically in one transaction, on-chain forensics can reconstruct every step even though the exploit contract itself no longer exists.

Source: Blockonomi