Gas spiked to 4,000 gwei at 0:14 UTC. That was the first signal. The second was a single 2.1 ETH fee for a contract call that didn't look like a normal transfer. I've been reading on-chain data for a decade. I knew something was breaking. By 0:47, an address ending in 9f3e had moved 0.0001 USDT from Aave to Arbitrum, and then started a sequence of swaps that would drain 47,000 ETH from a small lending protocol called Nimbus Finance. Over the next four hours, the attacker extracted roughly $120 million in total value. Not a single liquidation was triggered. Gas spike detected. Run.
Nimbus Finance launched in Q3 2025 as a “next-gen isolated lending market.” The idea was simple: each collateral asset lives in its own pool, with a single oracle price update every five minutes. Instead of the standard 0.5% liquidation threshold, Nimbus introduced a 10% “collateral floor” that was supposed to reduce unnecessary liquidations. For six months, it worked perfectly. TVL peaked at $1.4 billion. The protocol passed a security audit in October 2025 by a top-five firm. The report flagged no critical issues. The founders were active on X, posting monthly revenue charts. This morning, that structure collapsed.
Let me walk you through the exact sequence. I traced every transaction from the primary attacker address. The account borrowed 0.0001 USDT from the USDC pool, which is allowed because Nimbus does not enforce a minimum debt. Then the attacker bought 100,000 WETH from Uniswap V2 with that tiny loan. Wait, no—they used the USDT to purchase a small amount of a low-cap token called NIM, which is the protocol's own governance token. The liquidity pool for NIM/USDT on Uniswap V2 had a shallow depth of just 1 million USDT. By dumping 80,000 USDT into that pool, the attacker pushed the price of NIM up by 140%. This price move happened in a single block, so the Time-Weighted Average Price (TWAP) oracle on Nimbus, which averages over 60 minutes, still saw the old price. The attacker then used that inflated NIM as collateral to borrow 100,000 ETH from Nimbus's NIM pool.
The crucial detail is the collateral ratio. Nimbus uses a 10% floor. If the collateral ratio drops below 10%, the UI shows a “Liquidation Warning.” But the actual smart contract code, which I audited line-by-line after the incident, has a liquidationThreshold variable set to 0. The floor is only a visual indicator. The code only triggers liquidation when the collateral ratio reaches 0. In other words, the attacker could borrow against an asset whose real market value was 60% lower than the oracle price, and the protocol would still consider the position healthy. Because the oracle was lagging, the attacker could withdraw the borrowed ETH before the TWAP caught up.
The attacker repeated this process across three pools: USDT, NIM, and a third pool holding stablecoins. Each cycle used a fresh token pair and a fresh liquidity injection. In total, the attacker executed 34 swaps across Uniswap V2 and Curve, spending only 420 ETH in gas fees—less than 0.1% of the stolen value. No flash loans were used. The contracts were funded from a privacy wallet on BNB Chain. The entire operation was a surgical series of ordinary swaps, borrows, and withdrawals.
Now, the official narrative is that the attacker manipulated the oracle. That is a lazy excuse. A 40% price move in a shallow pool is not “manipulation”—it is normal volatility. The protocol should have survived that. The real fault is the design decision to set the liquidation threshold to zero. This is the same kind of “optimization” that I saw during the 2022 LUNA collapse. In that case, the protocol relied on an external swap mechanism to maintain the peg. When the price dropped below the threshold, there was no fallback. Here, Nimbus trusted that a collateral floor would be enough, but the floor was never a hard trigger.
Uniswap V2 moved the needle. Here’s how: the attacker exploited the difference between the spot price on Uniswap and the TWAP on Nimbus. The 5-minute TWAP gave them a window of 60 seconds to borrow against an inflated asset. The protocol’s risk engine didn't check the actual spot price; it relied entirely on the TWAP. This is a textbook example of a “price oracle skew attack” but the solution is not to add more oracle sources. The solution is to change the liquidation threshold to 0.5% and enforce it. Without that, any attacker can repeat this on any pool with similar parameters.
Here is the part that worries me most. The audit report from October 2025 explicitly reviewed the liquidationThreshold variable and stated that it was intentionally set to zero. The auditors wrote: “The liquidation threshold of 0 is designed to prevent premature liquidations. The protocol has implemented a collateral floor of 10% in the UI layer to warn users.” This is a fundamental misunderstanding of how DeFi safety works. A UI warning does not stop a bot. The auditors were convinced by the argument that the floor would protect users, but the floor is not enforced in the code. This is exactly the kind of “governance theater” that leads to hacks.
I have to stress-test every new protocol I evaluate. My method is to simulate attacks by reading the code myself. If I had looked at Nimbus’s code on day one, I would have flagged this. The fact that no one did—not the auditors, not the community, not the risk managers—shows a systemic blind spot in DeFi. We are all too focused on smart contract bugs like reentrancy and integer overflows, but we ignore economic parameters. These are the real kill switch.
The attacker has already laundered the funds. They moved the ETH through a coin-mixer and then swapped to a private coin on a dark-web exchange. The funds are unrecoverable. Nimbus’s insurance fund covers only 10% of the loss. The rest is gone. The protocol has already announced a “post-mortem” and a new oracle update. That update is irrelevant. The flaw is in the code’s core.
What should you do right now? If you have any funds in a protocol that uses a collateral floor below 1%, or that has a liquidation threshold of zero, you need to withdraw immediately. I have identified at least three other protocols on Arbitrum and Optimism that share the same code pattern. I have already sent a private report to their founders. But if they ignore this, I will go public in 72 hours. The market is a bear. You need to survive. Don’t rely on UI warnings. Check the code.
I am not a sensationalist. I am a forensic analyst. The data is all on-chain. I have included the attacker’s address and the transaction hashes in the footnotes. You can verify every step yourself. The truth is that the DeFi industry is still building on sand. We keep learning the same lessons: 2017 with ERC-20 rushed, 2020 with Uniswap V2’s market-making mechanics, 2022 with LUNA, and now this. The pattern is always the same: someone finds a loophole in the economic model, not the code. ERC-20 rush vibes. Proceed with caution.
The next 48 hours will be critical. Watch Nimbus’s social channels. If they propose a governance vote to change the liquidation threshold, that’s a red flag that they are trying to cover their own tracks. The real fix is to fork the code and deploy a new contract. Anything less is cosmetic. This is a wake-up call. The market is already in a downtrend. This hack will accelerate the distrust in DeFi lending. I expect a 10% drop in total value locked across similar protocols by the end of the week. If you have funds in isolated lending pools, do your own audit. Trust is not an option.