Attackers Drain $200K From Uniswap V3 via Incentive Flaw

Attackers drained an estimated $200,000 from Uniswap V3 liquidity pools on Ethereum by exploiting weaknesses in the WUSD.fi and GLOVE incentive system, according to security researchers at ExVul. The attackers cycled funds through multiple wallets to repeatedly farm rewards, taking advantage of flaws baked into the protocol's incentive structure. The event is small relative to recent DeFi hacks. It exposes a structural vulnerability that affects any protocol relying on reward-based liquidity mining.

The Wallet Cycling Exploit on Uniswap V3

The exploit did not rely on a smart contract bug in the traditional sense. Attackers abused the design of WUSD.fi and GLOVE incentive programs on Uniswap V3. These programs reward liquidity providers with tokens for depositing into specific pools. The attackers created multiple wallets, each depositing small amounts of liquidity. They then withdrew and redeposited the same funds repeatedly. Each cycle triggered a new reward claim, allowing the attackers to farm far more tokens than the intended allocation.

ExVul described the flaw as baked into the incentive structure itself. The protocol lacked checks to prevent a single entity from using multiple addresses to claim rewards on the same capital. This is not a new attack vector. Similar farming exploits have hit DeFi protocols like Harvest Finance and PancakeBunny in the past. The difference here is the specific targeting of Uniswap V3 concentrated liquidity pools. Rewards are tied to price ranges, which can amplify the impact when a single entity cycles capital across many addresses.

Exposure and Affected Assets

The direct loss is $200,000 in WUSD and GLOVE tokens, plus ETH used for gas fees. The affected pools were on Ethereum mainnet, not on layer-2 networks. Liquidity providers who had deposited into those pools during the attack window may have seen their share of rewards diluted. The stolen amount is small relative to total value locked in Uniswap V3.

Second-order effects are more concerning. The exploit demonstrates that any DeFi protocol with a multi-wallet reward system is vulnerable to the same technique. Protocols that rely on Uniswap V3 for liquidity may need to redesign their incentive distribution logic. The attack also raises questions about the security of AI-driven trading agents. These agents are increasingly used to automate yield farming strategies. If an AI agent can be programmed to cycle wallets faster than a human, the attack surface expands.