Ink Finance and Renegade Lose Combined $349,000 in Separate DeFi Exploits

Ink Finance and Renegade lost a combined $349,000 in separate DeFi exploits occurring within two days in May 2026. Ink Finance suffered approximately $140,000 drained from its Workspace Treasury Proxy contract on Polygon on May 11, 2026. Renegade lost approximately $209,000 from a legacy V1 deployment on Arbitrum on May 10, 2026, though a white hat returned around $190,000. Renegade confirmed the vulnerability was isolated to V1 and pledged to reimburse all affected users.

Ink Finance exploit

• ▪The attacker on Ink Finance deployed a contract at an address matching a whitelisted claimer entry in Ink Finance's Workspace controller, then called the claim function to pass the eligibility check and trigger an authorized transfer from the treasury proxy
• ▪Ink Finance suffered an exploit on May 11, 2026 that drained approximately $140,000 from the protocol's Workspace Treasury Proxy contract on Polygon
• ▪Ink Finance has not acknowledged or released any public statements on the exploit as of May 11, 2026
• ▪Blockchain security firm Blockaid flagged the Ink Finance exploit on May 11, 2026

Renegade exploit

• ▪Renegade stated that all affected users will be made whole following the May 10, 2026 exploit
• ▪Renegade raised around $3.4 million in a 2023 seed round led by Dragongly Capital
• ▪Renegade confirmed that the vulnerability was isolated to the V1 Arbitrum deployment and did not affect its other contracts
• ▪Renegade suffered an exploit on May 10, 2026 in which a legacy V1 deployment on Arbitrum was exploited for approximately $209,000
• ▪A white hat returned around $190,000 to Renegade following the May 10, 2026 exploit
• ▪Renegade held over $129,500 in total value locked across its Base and Arbitrum deployments as of May 11, 2026, according to DefiLlama
• ▪Renegade held over $338,000 in total value locked before the May 2026 hack

Syndicate bridge incident

• ▪Syndicate Labs announced on April 30, 2026 that it had suffered a security incident involving a private key compromise that enabled malicious upgrades to bridge contracts on two chains
• ▪Syndicate Labs sent reimbursements directly to affected wallets on Base, with gas fees covered by Syndicate Labs
• ▪Syndicate Labs stated on May 10, 2026 that it had reimbursed all affected SYND holders on Commons Chain in full, plus an additional 15% of the total amount lost
• ▪The Syndicate Labs security incident resulted in the loss of around 18.5 million SYND tokens and $50,000 in other tokens

AI-assisted attacks

• ▪An a16z Crypto research discovered that an off-the-shelf AI coding agent, given only a contract address and basic developer tools, could independently identify and exploit smart contract vulnerabilities 10% of the time
• ▪The success rate of an AI coding agent identifying and exploiting smart contract vulnerabilities went up to 70% when the agent was provided with structured knowledge about common attack patterns
• ▪GoPlus Security flagged four separate smart contract exploits on Ethereum mainnet within a 48-hour window ending April 29, 2026, with combined losses exceeding $1.5 million

April 2026 DeFi losses

• ▪Ink Finance and Renegade lost a combined $349,000 in separate exploits that occurred in less than two days in May 2026
• ▪April 2026 was the worst month on record for smart contract losses

Perspective of Renegade

• ▪Renegade stated that all affected users will be made whole following the May 10, 2026 exploit
• ▪Renegade confirmed that the vulnerability was isolated to the V1 Arbitrum deployment and did not affect its other contracts