We’re excited to announce the next step in Notional’s journey: Notional Exponent - the world’s first leveraged yield protocol.

Notional V1 Exploit Post-Mortem On September 3, 2026, Notional V1 was exploited on Ethereum for roughly 1.65M USDC and 69K DAI. The Notional Team paused the affected contract shortly afterward to protect remaining user funds. Notional V1 was publicly deprecated in January 2022 following the launch of Notional V2, but withdrawals remained available indefinitely for users who kept assets in the protocol. The exploited funds were residual assets that remained in the legacy V1 Escrow contract. No exploited funds have been recovered, but the team is engaging with US law enforcement and a leading crypto incident response firm to pursue any possible recovery. No other funds in any Notional product are at risk. The exploit The attacker caused an integer overflow error related to the mintfCashPair function. This error enabled him to create a large debt in one account, bypass the collateral check on that account, and then transfer an unbacked collateral position to a second account. Following this setup, the attacker borrowed against that unbacked collateral position from the second account and drained the Notional V1 Escrow. Exploited contract: 0x9abd0b8868546105F6F48298eaDC1D9c82f7f683 Exploit transaction: 0xc3f3e318f7ab2d0daaba59e6ec901d25d1fe8a89aafe2b2b62e3b9aee1a24efa Find a deep-dive on the details of the exploit on the Quill Audits blog. The response Immediately following the exploit, the Notional Team investigated the transaction, confirmed that it was likely an exploit, and moved to pause the contract to protect remaining funds. Shortly after this initial investigation, the team upgraded the Notional V1 contract and paused all operations. Pause transaction: 0x012fc554b165b3b3ccf3121018ae26503cab50031fa84adea29253b1cd5831d9 The Notional Team alerted security partners shortly thereafter and has since engaged with US law enforcement and Zero Shadow, a crypto incident response firm, to pursue all possible avenues toward recovery. These recovery efforts are ongoing and the Notional Team will make an additional announcement in the event of any asset recovery or distribution. Legacy contract management This exploit highlights a shortcoming in Notional’s policy of legacy contract management. Although Notional V1 had been deprecated for nearly five years, substantial user assets remained. Given the pace of evolution in smart contract security, legacy contracts must be handled with the same ongoing scrutiny as production contracts. Smart contract security is a moving target, not a static one. Going forward, any Notional smart contract deprecation plan will include a mechanism to migrate or return all user assets to ensure that no funds are left idle indefinitely in legacy contracts. Thank you for your patience as we work to resolve this incident.

Notional V1 Security Incident Notional's legacy V1 contract was exploited last night for ~$1.7M of user funds. We have identified the vulnerability and paused the affected contract. No other user assets, including assets in Notional Exponent, are at risk. We are pursuing all available avenues to recover user funds. We will provide an update as soon as we have a detailed post-mortem or more important information to share. Thank you for your patience as we work through this.

The new $liUSD-4w market with @infiniFi is a big success! 🔥🔥🔥 All capacity was utilized within the first week. But good news anon - more liquidity is coming from @ClearstarLabs ! Capacity will go fast. Better get ready 👀

We have unpaused the $mAPOLLO vault and can confirm that it is fully operational. Deposits and withdrawals are active. @ApolloCryptoFM has no remaining Resolv exposure and did not lose any money in this incident