Blockchain investigators reported on Thursday that roughly $1.7 million left an escrow contract linked to Notional Finance, the Ethereum-based fixed-rate lending protocol, in what would be the latest DeFi exploit of the week — though the project itself has yet to confirm any incident.
What Investigators Report
The findings come from blockchain investigation group Specter, whose report was cited by security firm PeckShield on Thursday morning. According to both, approximately $69,242 in DAI and $1,658,423 in USDC — about $1.7 million combined — left an escrow contract associated with the protocol.
The suspected attacker then exchanged the stablecoins for 689.2 ETH and deposited the proceeds into Tornado Cash, the Ethereum mixer that obscures the link between deposits and withdrawals.
Researchers identified two Ethereum addresses allegedly connected to the movement: 0xC954…De69 and 0xDaCC…Ce38. Specter labeled both as theft addresses — a description that remains an investigator attribution rather than a finding confirmed by Notional Finance, law enforcement, or a court.
No Official Response Yet
Notional Finance had not published a public incident report or confirmation through its official channels when this article was prepared. The available reports do not identify the precise escrow function involved, and they do not establish whether the event resulted from a smart-contract vulnerability, compromised credentials, faulty permissions, or another cause.
It is also unclear whether the affected assets belonged directly to users, to the protocol treasury, or to another party using the escrow contract. Notional's documentation describes a lending system in which deposited currencies support borrowing obligations denominated in other currencies, making contract-level accounting central to user positions — but the evidence so far does not show whether open loans, collateral balances, or fixed-term positions were affected.
Tracing Outlook
The rapid conversion from DAI and USDC into ETH may limit the usual containment options. Both stablecoins are publicly traceable and can be frozen by their issuers in cooperation with platforms, but those levers become largely irrelevant once funds are swapped and pushed through a privacy protocol like Tornado Cash.
DeFi protocols that respond quickly have in some cases contained comparable incidents — pausing contracts, contacting issuers and exchanges, and negotiating returns — but that window narrows after mixer deposits. Until Notional confirms which contract was involved and how the transactions were authorized, the reported $1.7 million figure should be treated as preliminary.
TrustGrade tracks the security posture of DeFi protocols and infrastructure. Security scans with verified, registry-backed scores arrive with TrustGrade Code Scoring in December 2026.