Huma Finance Hit by $101K Legacy Contract Exploit

Steady attention without excessive speculation.

Background

he Huma Finance exploit targeted deprecated V1 BaseCreditPool contracts on Polygon. These contracts belonged to Huma’s earlier infrastructure and existed before the April 2025 launch of Huma 2.0 on Solana. Although Huma had already moved toward sunsetting these v1 pools, some residual protocol fees and pool-owner fees remained inside three affected addresses. Together, these balances totaled roughly $101,400.

The attacker used a public state-transition flaw in the BaseCreditPool contracts to drain the funds without needing privileged access. Therefore, the incident appears limited to leftover funds in old Polygon-based contracts, rather than active user deposits or Huma’s current Solana-based system. This is the first reported smart contract exploit affecting Huma Finance. Until now, the protocol had maintained a clean public security record since its founding.

Huma has also built a notable profile in the PayFi sector, supported by more than $38 million in funding and a leadership team with experience across major technology and fintech companies. Still, the incident shows that even protocols with strong teams and active migrations can face risk when legacy contracts remain live with value inside them.

However, similar DeFi incidents involving deprecated or legacy contracts have often produced muted reactions when attackers only drain protocol-owned fees and leave user deposits untouched. In those cases, traders usually focus on three questions: whether user funds were affected, whether the active protocol remains secure, and whether the team responds quickly.

So far, early indications suggest that HUMA has not seen a major price reaction. That aligns with the limited scope of the exploit, since the affected contracts belonged to legacy v1 infrastructure rather than Huma’s active v2 PayFi system.

Huma’s Response and Mitigation Efforts

Huma Finance responded quickly by pausing all v1 pools and accelerating the sunsetting process already underway. In addition, co-founders Richard Liu and Erbil publicly clarified that the exploit affected only protocol fees and pool-owner fees. They also reiterated that user capital, PST, and the Solana-based v2 protocol remain unaffected.

This distinction matters because Huma v2 operates as a ground-up rewrite rather than a direct continuation of the vulnerable v1 contracts. As a result, the vulnerability in the Polygon legacy pools does not appear to carry over into the current Solana-based system.

Meanwhile, security firms including Blockaid and ExVul published on-chain analysis that supported the limited-scope assessment. Huma also said it will share further technical details as its root-cause investigation continues.

Implications for DeFi and Huma’s Outlook

This exploit highlights a recurring DeFi security problem: legacy contracts can remain risky even after a protocol migrates to newer infrastructure.

In practice, old contracts can become “zombie” risk surfaces when teams leave residual assets, fee balances, or administrative flows inside them. Even if the active protocol has moved on, attackers can still target those remaining balances if the contracts retain exploitable logic.

For Huma, the immediate financial damage appears contained. The attacker drained about $101,400, and Huma says user funds, PST, and v2 operations remain safe. That limits the direct impact on the protocol’s core PayFi business.