GONDI Hack

GONDI is an NFT lending protocol where people can borrow crypto using their NFTs as collateral, or lend to earn interest. On 20 February 2026, GONDI released a new version of its Sell & Repay feature, which lets borrowers sell a pledged NFT and repay their loan in one step. This update included a flaw in the Purchase Bundler contract behind the feature. On 9 March 2026, an attacker used the flaw to move NFTs out of wallets that had approved the contract. According to GONDI, NFTs held as collateral in active loans were not at risk.

The attacker took 78 NFTs, including Art Blocks, Doodles and Beeple pieces, worth roughly $230k according to third-party estimates. GONDI disabled the Sell & Repay feature and asked users to revoke their approvals, while buying, selling, listing and bidding kept working. The team said it would make affected users whole by repaying them directly, returning stolen NFTs where possible and using protocol fees to buy comparable NFTs. GONDI and community members also tracked down and returned some stolen NFTs that had been resold to unaware buyers.

According to reports shortly after the attack, GONDI had not yet deployed a fix and kept the Sell & Repay feature disabled instead. Blockaid and an independent auditor reviewed the platform and found it safe to use. GONDI listed six Purchase Bundler contracts on Ethereum and HyperEVM as affected, and asked everyone who approved any of them to revoke those approvals. Revoking protects the NFTs still in your wallet, but it does not recover NFTs that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.