Meta Pool Hacker Mints $27M in Tokens, Leaving With $132K

🎁 Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. JOIN NOW! 🔥

Meta Pool Hacker Mints $27 Million in Tokens, Walks Away With Just $132,000

Written by Aaron S.,

Editor-In-Chief

Last Updated: June 18, 2025

Key Takeaways

A Meta Pool exploit allowed a hacker to mint $27 million in tokens, but they could only cash out $132,000 worth of Ethereum;
The flaw came from a "fast unstake functionality" that bypassed the usual waiting period for withdrawals;
Meta Pool confirmed that all user-staked ETH remains secure and continues to earn rewards through the SSV Network.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now ! 🔥

BITDEGREE IN YOUR SOCIAL FEED

A recent exploit targeting Meta Pool resulted in the attacker walking away with just over $132,000 worth of Ethereum ETH $2,486.38 , despite mining nearly $27 million in tokens.

Meta Pool stated in a blog post published on June 17 that this was due to a combination of low trading activity in the token’s markets and a fast response from Meta Pool’s team, who paused the affected smart contract soon after identifying the issue.

The attacker exploited a flaw in Meta Pool’s "fast unstake functionality", according to co-founder Claudio Cossio.

What is Balancer in Crypto? Beginner Friendly BAL Explainer

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Normally, when someone unstakes their cryptocurrency, there is a delay before they can use it again. The fast version skips that waiting period under certain conditions. This shortcut allowed the attacker to issue 9,705 units of mpETH, the platform’s token used for staking.

According to Meta Pool, the exploit used the ERC4626 mint() function to create these tokens without proper permission. The attacker then tried to swap the fake mpETH for actual ETH across different pools on Ethereum and Optimism. They were able to get only 52.5 ETH, which was worth just over $132,000.

PeckShield confirmed that the contract had a major flaw, but the limited market depth of mpETH made it hard to profit from. Some of the swap pools targeted had very little liquidity, which kept the losses low.

Meta Pool’s team reassured users that all staked Ethereum remains safe. Those funds are handled by operators on the SSV Network, who continue to validate transactions and earn staking rewards.

On June 14, blockchain security firm SlowMist reported that a crypto holder lost nearly $6.9 million. How? Read the full story.