WUSD.fi Sybil Farming Attack Drains $200K from GLOVE Pools

A sybil farming attack on WUSD.fi and GLOVE drained roughly $200K from Uniswap V3 liquidity pools on Ethereum. No audit caught the reward mechanic flaw.

Somebody figured out the math before the protocol did. On May 25, a single attacker walked away with roughly $200K from two Uniswap V3 pools tied to the WUSD.fi and GLOVE protocol on Ethereum. Not a bug in the contract code exactly. More a case of a reward mechanism that never asked who it was rewarding.

Blockchain security researcher exvulsec flagged the incident on X, laying out the full on-chain trail. The attacker used a flash loan, cycled through fresh wallets, and dumped harvested GLOVE tokens into the liquidity pools before anyone caught it.

The Mechanic Nobody Stress-Tested

Inside WUSD.fi’s contract sits a function called WUSD._englove. According to exvulsec on X, any fresh wallet wrapping at least 100 WUSD while holding under 2 GLOVE could call Glove.mintCreditless and receive up to 2 GLOVE tokens. No identity check. No rate limit. Nothing.

The attacker deployed EIP-7702 helper contracts, pulled a Morpho USDT flash loan, then ran repeated wrap and unwrap cycles across fresh wallet addresses. Each new address qualified again. GLOVE kept minting.

Harvested GLOVE went straight into Uniswap V3. The GLO-USDC pool lost 11,702 USDC in observable drains. The GLO-USDT pool shed 8,079 USDT. Both figures confirmed via Etherscan at time of reporting.

What the Community Clocked

SecureAI on X put it plainly: the exploit was not the contract itself. It was the reward mechanism design. Audits tend to look at code logic. They rarely stress-test economic incentive paths the way an attacker will.

Chinese-language crypto account aegixe_cn on X called it another incentive abuse attack and warned users to understand a protocol’s mechanics before putting money in. That kind of reminder lands differently when $200K has already left the pool. DeFi exploits have been stacking up this year, with May alone seeing multiple liquidity-layer incidents across Ethereum.

No oracle manipulation. No reentrancy. Just a minting function handing out tokens to anyone who showed up with a fresh address. The attack kept going as long as new addresses kept qualifying. And they did, part of a pattern that has cost DeFi nearly $770M in 2026. Per the filings.