DeFiTuna loses $580K in exploit, leaving USDC pool in deficit

DeFiTuna, a Solana-based lending protocol, lost $580,000 in an exploit on July 16, creating a deficit in its USDC lending pool.

The team said it identified and patched the attack vector hours after the incident, though it has not disclosed how affected depositors will be made whole. "Recovery efforts and a deeper investigation into the exploit are underway," the protocol said.

The attacker drained funds from DeFiTuna's lending pools, leaving liabilities in the USDC pool exceeding assets by the full $580,000 amount. DeFiTuna operates as an automated market maker with native lending, concentrated liquidity, and leveraged position support on Solana. Users deposit assets into pools that others borrow against, earning variable APY based on utilization rates. The protocol's native token, $TUNA, is used for staking and revenue sharing, giving holders a claim on ecosystem fees.

For depositors, the immediate question is whether the deficit will be covered through treasury funds, socialized across all pool participants, or recovered from the attacker. The protocol previously returned investments from Kelsier Ventures in February 2025 after a scandal involving that firm. The team's next public communication — expected to include a detailed post-mortem explaining the exploit mechanism and a concrete plan for addressing the USDC deficit — will be critical for restoring user trust. User reactions on social media have centered on two questions: whether depositors will absorb the loss and why the exploit was not caught during audits.

The incident adds to a growing list of DeFi security breaches in 2026, highlighting persistent risks in decentralized lending markets where smart contract vulnerabilities can produce immediate, irreversible losses. For DeFiTuna, the path to recovery depends on transparency and the speed of remediation.

This article is for informational purposes only and does not constitute investment advice.