.jpg)
The Notional Finance exploit that surfaced Sept. 4 saw roughly $1.7 million leave an escrow contract tied to the fixed-rate lending protocol, blockchain investigators reported — with the attacker converting the stablecoins to Ether and routing the proceeds through Tornado Cash before the project had publicly said a word.
Blockchain investigation group Specter first reported the movement: approximately $69,242 in DAI and $1,658,423 in USDC left the escrow contract, and the suspected attacker exchanged the haul for about 689.2 ETH before depositing it into Tornado Cash, the Ethereum mixing protocol that obscures the connection between deposits and later withdrawals. Security firm PeckShield amplified the finding while carefully preserving the incident's provisional status — "the Notional Finance escrow contract may have been exploited" — and shared the details on X (Twitter):
"Specter has reported that the Notional Finance escrow contract may have been exploited, resulting in $1.7M in DAI and USDC lost. The exploiter has swapped the stolen funds into 689.2 ETH and deposited them into Tornado Cash." — PeckShieldAlert (@PeckShieldAlert), September 4, 2026
What the Notional Finance exploit details show
Investigators identified two Ethereum addresses allegedly connected to the movement — 0xC954…De69 and 0xDaCC…Ce38 — labeled as theft addresses by Specter, though that attribution remains an investigator's label rather than a finding confirmed by Notional, law enforcement or a court. Notably absent from every public report is the technical cause. The available evidence does not establish whether the event stemmed from a smart-contract vulnerability, compromised credentials, faulty permission settings or another failure mode entirely, and it remains unclear whether the affected assets belonged to users, the protocol treasury or a third party using the escrow contract.
The attack playbook is nonetheless familiar in its efficiency. Stablecoins can be tracked publicly before conversion — both DAI and USDC are traceable onchain — but issuers and centralized platforms can also restrict them, which makes rapid conversion to ETH a standard first move. Depositing into Tornado Cash further complicates blockchain tracing, though the deposit itself does not independently prove criminal ownership, and recovery options narrow sharply once assets enter a mixer. In related coverage, an address tied to the Drift Protocol exploiter moved $44 million through Tornado Cash after months of inactivity, showing the same post-exploit laundering pattern at fifteen times the scale.
Notional's silence and the recovery question
When last checked, Notional had published no incident report or confirmation through its official channels, and had not disclosed whether contracts were paused, whether remaining assets were secured, or whether users needed to take protective action — an unusual silence given that DeFi teams typically respond within hours of a public alert. Notional operates as an Ethereum-based lending protocol focused on fixed-rate, fixed-term borrowing, a design that makes escrow contracts central to its operation and makes an unexplained escrow drain particularly consequential for user confidence.
The precedent for recoveries depends almost entirely on rapid containment. Term Labs recovered affected fixed-rate positions after an $8.5 million governance exploit, though several products stayed closed, and Stake DAO secured its Ethereum backing and closed a bridge after an unauthorized minting incident. Those cases involved immediate project responses that Notional has not yet matched, and the week's other lending-protocol failure ended in a chain rollback — a reminder that the first 24 hours determine whether a $1.7 million incident becomes a footnote or a crisis. With exploit frequency climbing across DeFi, the industry's exposure is no longer the hacks themselves but how quickly teams confirm, communicate and contain them. The reported loss should be treated as preliminary until Notional confirms the incident — but the funds' path through Tornado Cash is already public record, and whoever holds those keys knows the clock is running.
