dTRINITY dLEND Hack

dTRINITY is a DeFi project built around its own stablecoin, dUSD. Its lending product, dLEND, is based on Aave V3 and lets people lend and borrow against their deposits. dLEND also offered collateral swaps, which let borrowers switch one type of deposit for another through separate helper contracts. On 28 September 2025, an attacker found that these swap contracts let anyone start a swap on behalf of any other wallet. This let them take the deposits of wallets that had given the contracts a large or unlimited approval, leaving only a tiny amount behind.

In total, $56k was taken across Fraxtal and Sonic. According to dTRINITY, all of the affected funds belonged to its own team members, who had given the contracts large approvals during testing. The dTRINITY website only asked users to approve the exact amount needed for each transaction, which limited the damage. While it investigated, the team briefly paused dUSD transfers. It then removed the swap feature from its website, published a post-mortem and said it would cover the team members' losses itself.

The affected swap contracts were only removed from the dLEND website, which does not stop existing approvals to them from being abused. dTRINITY asked anyone who had ever approved these contracts to revoke those approvals right away, and promised security improvements and a new round of audits. If you used collateral swaps on dLEND on Fraxtal or Sonic, check your approvals and revoke any that point to the listed contracts. Revoking protects what is still in your wallet, but it does not recover funds that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.