Meta Pool Stops Hacker Attack: Quick Unstake Vulnerability Allowed Creation of Uncollateralized mpETH Tokens, But Low Liquidity and Quick Response Minimized Damage

Meta Pool, a multi-chain liquid staking protocol, has suffered a critical attack in which an attacker exploited a vulnerability in a smart contract and created mpETH tokens worth about $27 million . However, due to the low liquidity of the affected pools and the rapid response of the Meta Pool team, the hacker was only able to withdraw about 52.5 ETH (approximately $132,000) 1 3 9 .

How the attack happened

The hacker exploited the “fast unstake” feature, which allows users to withdraw funds immediately under certain conditions. This feature typically requires a check of available liquidity before issuing tokens, but the attacker found a way to bypass this check and issued 9,705 mpETH tokens without any real assets backing them 1 3 7 .

Security platform PeckShield described the vulnerability as a “critical bug” because the contract allowed mpETH to be minted freely without any real collateral, which could theoretically lead to unlimited losses. However, the limited liquidity of mpETH in exchange pools significantly limited the attacker’s ability to convert counterfeit tokens into Ethereum 1 9 .

Implications for Meta Pool and Users

The attacker attempted to exchange the created tokens in liquidity pools on the Ethereum and Optimism networks, which allowed him to withdraw only about 52.5 ETH. The Meta Pool team quickly suspended the vulnerable smart contract, which prevented further losses. At the same time, all the main Ethereum placed in staking remained safe, as it is delegated to SSV validators, who continue to verify blocks and receive rewards on the main network 1 3 .

Meta Pool has announced that it has launched an investigation into the incident and plans to provide a full report and recovery measures in the coming days. The affected mpETH contract will remain locked until the investigation is complete. The team has also promised to compensate users for lost assets, guaranteeing damages 1 .

Context and similar incidents

The incident is part of a growing wave of attacks on DeFi protocols. For example, on June 6, DeFi platform Alex Protocol on the Stacks blockchain crashed after $8.3 million was stolen due to a bug in the listing logic. Also, Taiwanese crypto exchange BitoPro confirmed a security incident that resulted in over $11.5 million being stolen from hot wallets 1 .

The significance of the incident

The Meta Pool attack highlights the importance of robust smart contract security and early threat detection systems in the DeFi sector. Despite a massive attempt by an attacker to create counterfeit tokens worth tens of millions of dollars, the combination of low liquidity and the team’s quick response allowed the damage to be minimized and users’ trust in the protocol to be maintained.

Meta Pool, which provides liquid staking for multiple blockchains including Ethereum, NEAR, Solana and others, continues to work on strengthening security and recovering lost funds, which is key to the further development of the decentralized finance market 1 3 9 .

What measures did Meta Pool take to quickly respond to the hacker attack?

Meta Pool took a number of operational measures to quickly respond to the hacker attack, which allowed us to minimize damage and prevent further losses. In particular:

The early threat detection system allowed the Meta Pool team to quickly identify unauthorized activity and immediately suspend the vulnerable smart contract, which stopped further creation and issuance of counterfeit mpETH tokens 1 .
Due to this quick response and the low liquidity of the affected exchange pools, the attacker was only able to withdraw around 52.5 ETH (approximately $132,000), despite having created around $27 million worth of tokens 1 .
The Meta Pool team has blocked the vulnerable mpETH contract until the investigation into the incident is complete, preventing the exploit from being used again 1 .
The platform also announced plans to fully investigate the incident and develop a recovery plan, including compensation for lost assets to users 1 .

Thus, the key measures were the timely detection of the attack, the rapid shutdown of the vulnerable smart contract and the blocking of further transactions with it, as well as the promise of compensation for damages and a detailed investigation.

How a ‘quick unstake’ vulnerability allowed an attacker to create mpETH tokens

A vulnerability in Meta Pool’s “fast unstake” feature allowed an attacker to create mpETH tokens without any real collateral. This feature typically requires a check for available liquidity before issuing new tokens to avoid issuing “dummy” tokens. However, the hacker found a way to bypass this check, allowing him to illegally mint between 9,705 and 10,600 mpETH tokens without any actual Ethereum collateral 1 2 .

Security platform PeckShield described the vulnerability as a “critical bug” because the contract allowed mpETH to be minted without collateral, effectively creating tokens “out of thin air” 1 2 . The attacker then attempted to exchange the fake tokens for ETH via liquidity pools on the Ethereum and Optimism networks, but was only able to withdraw about 52.5 ETH (approximately $132,000) due to the low liquidity of the pools 1 2 .

Thus, the key problem was to bypass the liquidity check mechanism when quickly withdrawing from staking, which allowed the hacker to generate a large amount of mpETH for free.

Why Low Pool Liquidity Limited the Damage in This Incident

Low liquidity of exchange pools limited the scope of damage in the Meta Pool incident for the following reasons:

The limited amount of assets in the pools meant that the attacker could not quickly and in large quantities exchange the fake mpETH tokens for Ethereum. Due to the small reserve of liquidity, attempts to sell a large number of tokens resulted in a sharp drop in their price and significant slippage, which made the exchange unprofitable and technically difficult.
High slippage and price volatility in low-liquidity pools limited the hacker’s ability to convert minted tokens into real ETH at market value. This significantly reduced the amount he was able to withdraw — only about 52.5 ETH (~$132,000), despite creating tokens worth about $27 million.
Low liquidity gave the Meta Pool team time to react as the attacker’s scale was limited, allowing them to quickly suspend the vulnerable contract and prevent further losses.

Thus, the low liquidity of the pools acted as a natural barrier that reduced the financial damage from the exploit, limiting the attacker’s ability to quickly and massively convert counterfeit tokens into real assets 2 5 .

What steps does the Meta Pool team plan to restore and compensate affected users?

The Meta Pool team is planning the following key steps to recover from the incident and compensate affected users:

Conducting a full investigation of the incident with a detailed analysis of the vulnerability, attack mechanisms and consequences. A report with the results and a plan for further action will be presented within a few days.
Blocking the vulnerable mpETH smart contract until the investigation is fully completed to prevent the exploit from being reused.
Develop and implement a recovery plan that includes measures to eliminate vulnerabilities and improve protocol security.
Compensation for lost assets to users , which ensures that all those affected by the attack are compensated for their losses.

As such, Meta Pool is focused on a comprehensive approach, from technical analysis and vulnerability mitigation to financial compensation and restoring user trust. These measures are aimed at minimizing the impact of the incident and strengthening the platform’s security in the future.

What is the critical danger of the vulnerability discovered in the mpETH contract

The critical danger of the vulnerability in the mpETH contract is that it allowed an attacker to issue mpETH tokens without the corresponding collateral , i.e. create liquid tokens “out of thin air” without any real collateral in Ethereum. This violates the fundamental rule of collateralizing liquid tokens, leading to devaluation of the token itself and potentially serious financial losses for the protocol and its users.

This vulnerability is a “critical bug” because it undermines trust in the liquid staking system and opens the door to large-scale exploits. In the case of Meta Pool, it was the bypass of the liquidity check mechanism in the “quick unstake” feature that allowed the attacker to mint about 9,705 mpETH tokens without any actual collateral.

More generally, such vulnerabilities are often related to errors in smart contract logic that allow attackers to manipulate the state of the contract, such as through reentrancy attacks — when a contract is called again before the previous operation has completed, which can lead to theft of funds. While in the specific case of Meta Pool, the main issue was bypassing liquidity checks, such logic errors are considered to be among the most dangerous in the Web3 space.

Thus, the critical danger of the mpETH vulnerability lies in the possibility of illegal creation of tokens without collateral , which threatens the integrity and security of the protocol, as well as the financial interests of its users 3 1 .

What is the main danger of the reentrancy vulnerability in the mpETH contract

The main danger of the reentrancy vulnerability in the mpETH contract is that it allows an attacker to repeatedly call contract functions before the previous operation completes , which leads to incorrect accounting of balances and can lead to theft of funds.

Specifically, in this attack, the contract transfers funds to the attacker before updating its internal state (e.g. the user’s balance). The attacker, using a malicious contract, calls the withdraw function again while receiving funds, and since the balance has not yet been updated, the contract transfers funds again. This cycle can be repeated many times, allowing for the theft of much more funds than intended.

In the case of mpETH, such a vulnerability could allow an attacker to:

Issue tokens or withdraw ETH multiple times, bypassing contract restrictions.
Manipulate the state of a contract by causing repeated transactions before previous ones are completed, leading to accounting errors and loss of funds.

The reentrancy attack is one of the most destructive in Web3, as exemplified by the 2016 attack on The DAO, where a hacker stole millions of dollars due to a similar vulnerability.

Thus, the critical danger of the reentrancy vulnerability in mpETH is the ability of an attacker to use repeated function calls to repeatedly withdraw funds or create tokens without limitation , which compromises the security and financial integrity of the protocol 1 2 .