Flash Trade experienced a security issue resulting in a loss of $98,000 in USDC due to a flaw in the MagicBlock SDK. However, the team assures users that their funds are safe and unaffected.
On July 22nd at 12:21 AM SGT, Flash Trade, a perpetuals exchange built on Solana, experienced a security breach resulting in the theft of $98,000 worth of USDC. The problem was caused by a mistake in the code of MagicBlock’s SDK, which allowed an attacker to bypass security measures and use a fraudulent account.
As an analyst at Flash Trade, I can confirm that our new batching and monitoring systems quickly identified some unusual activity – within just minutes, in fact. We immediately took precautionary steps by temporarily halting all deposits, withdrawals, and trading to ensure everything was secure.
Flash Trade and MagicBlock both assured users they will receive a full refund, and their account balances won’t be affected.
MagicBlock SDK Flaw Behind the Flash Trade Exploit
The problem stemmed from a flaw in how MagicBlock’s software checked information when handling requests from Ephemeral Rollups. Specifically, an incomplete verification step within the #[ephemeral] Anchor macro – which manages responses between smart contracts and Ephemeral Rollup – was identified as the source of the issue.
On July 22nd at 12:21 AM Singapore time, Flash was attacked and lost $98,000 worth of USDC.
As an analyst, I can tell you that our Flash system quickly detected unusual activity through its batching and monitoring capabilities. We reacted swiftly, pausing all deposits and withdrawals within just a few minutes. Thankfully, no additional funds were affected.
— MagicBlock ✨ (@magicblock) July 22, 2026
The attacker used software to create a fake transaction that looked like a legitimate user deposit.
During the same operation, that account was used as temporary storage for another process – specifically, canceling a previous authorization. The system verified this storage belonged to the program handling authorizations, but it failed to check if the storage matched the expected security settings.
This vulnerability allowed the hacker’s access to appear valid, causing a false confirmation message and enabling them to steal funds.
MagicBlock checked all similar programs using the same method and reached out to the teams responsible for those programs directly.
The software development kit (SDK) has been updated to version 0.16.2, which automatically includes a necessary security check. If you’re using an older version, the company strongly recommends upgrading right away.
Read also:
Wanchain Cardano Bridge Exploited, 515M NIGHT Drained From Treasury
Flash Trade’s Response and Fund Recovery Timeline
Flash Trade reported that their new system for grouping and watching transactions quickly detected the unusual activity.
Trading was temporarily stopped, along with deposits and withdrawals, while our team investigated an issue with MagicBlock. Trading was restored within a few hours, but it took about 24 hours to fully resolve the issue and reopen deposits and withdrawals.
The team explained that they intentionally sequenced these steps to ensure all funds were correctly accounted for *before* allowing users to withdraw again.
Flash Trade and MagicBlock worked together to fully cover all losses for impacted users, ensuring nobody would lose their funds.
Industry Reaction to the Solana Perpetuals Exchange Hack
Backpack CEO Armani Ferrante spoke out about the incident, calling it another instance of someone taking advantage of how profits are calculated. He suggested a solution: creating a separate, thoroughly checked contract to hold funds and requiring a 24-hour delay for any withdrawals.
Another day another DeFi hack on a margin system.
Here’s the simple solution to minimize the damage of hacks by 10x.
All margin systems are constructed the same way.
When you add funds to a margin account, you give up direct control of those assets. The margin…
— Armani Ferrante (@armaniferrante) July 22, 2026
Ferrante explained that this design would allow platforms to immediately stop withdrawals if they were under attack. This quick action would help minimize losses from issues like unreliable data sources, compromised user accounts, and unfair trading practices.
He also praised Flash Trade for acting quickly and effectively, noting they responded to the situation as well as other comparable teams.
MagicBlock stated they will keep collaborating with partners like system builders, security checkers, and research experts to improve the security of their software development kit in the future.
2026-07-22 20:47