HOSKY

ᗰᒍ Verified account @Jinx_MJ_K · 3d

@snekdotfun has been hacked
the site has been down since 26th Oct

Yet the @snek team and Devs thinks it is fine to just post about this Incident on Discord and not to the thousands of followers on X

As a company you need to put the report here!

Everyone is quick to jump on the band wagon when other platforms got funds stolen yet the Snek community and Founders are not dead quiet?

This is not how a company should be operating IMO this has been days already.

Impact
- 268 transactions over about 17 hours on 29 Oct
- 10,717 pre-bonded pools affected
- About 185,700 ADA, plus the tokens in those pools, lost
- Our team reached the other at-risk pools first and moved about 217,600 ADA to a safe wallet

And for all the people thinking about commenting and trying to defend them not posting on X about this just keep quiet as you do not have a leg to stand on.

From small project to large ones should let everyone know sooner than later and once the report is out do an update post.

There opening summary:

Incident date: 29 October 2026
Report date: 4 November 2026
Network: Cardano Mainnet
Status: A fixed N2T factory has been published. The disposition of pools bound to earlier factory witnesses and the final recoverable loss are still being assessed.
Summary
We identified an input-accounting flaw in the N2T bonding-curve factory used to move pools into Splash AMM. The factory checked the migration conditions against one selected pool input but did not require that this be the transaction's only spending input. Other bonding-curve pool inputs could therefore be consumed in the same transaction without their ADA being accounted for by the factory's per-pool transfer check. The bonding-curve pool validator accepted the factory withdrawal as authorization for each of those inputs.
The initial transaction identified in the investigation was 502c1782…f294b. A second reviewed transaction was 53d94c80…71d6. Each consumed 41 UTxOs at the N2T pool script, including 40 UTxOs carrying a pool NFT, and produced one AMM-script output and one ADA output to the same payment-key address.

Across the observed 29 October window, 268 transactions match this 41-input pattern and direct their ADA output to the attacker address identified by the team. They consumed 10,717 distinct pool-NFT-bearing UTxOs containing 185,711.837862 ADA. That is the gross ADA in those inputs, not a final user-loss figure. The team's separate containment activity, ownership of some pools, recovery of assets, and later transfers must be reconciled before a definitive loss amount is published.

Please do better I do not believe this was the best way to handle this matter. @golden_Rapha @goofy_crisp @CardanoRami @yashablack

As a Community we need to react faster to things of this nature as it will be happening more and more. This is nothing personal for those keyboard warriors out there so chill. Optics matter in these scenarios.

View quoted post on X