Update: you can find our full technical report on the incident here.
What happened?
On September 10th, 2025, Request Finance identified a compromise of our official frontend.
The issue was contained immediately, and investigations are ongoing with the support of external specialists.
Who was affected?
Only one client was affected by this incident. We are working closely with them to complete a full post-mortem and recovery plan.
Is there a wider impact?
No, this was an isolated case, and there is no evidence of wider impact on other users of the Request Finance platform.
How did the incident occur?
Attackers compromised the Request Finance frontend and injected approval into a contract that looks like ours (name, address, ABI partially, recent activity) but is not. When paying, the victim not only sent funds to the regular contract but also approved the fraudulent one to spend unlimited USDC. Both actions were batched in a Safe wallet transaction. In detail:
Attackers created a contract starting with 0x3Cf6 and ending with c03F, on mainnet, while the correct contract is 0x3cF63891928B8CeebB81C95426600a18cd59C03f. The malicious contract has an additional method, `claimToken,` which attackers can call to empty a victim's wallet (up to its ERC20 allowance).
Attackers compromised the Request Finance frontend, injecting approval logic under conditions such as minimum USDC balance.
When paying, with this compromised logic, the victim not only sent funds to the regular contract but also approved the fraudulent one to spend unlimited USDC. Both actions were batched as a transaction proposed for signature to a Safe. The batched action got the required approval and was then executed (to be precise, 3 similar actions were executed at once, but it does not change the outcome).
Within 2 minutes, attackers called `claimToken,` to empty the victim's wallet’s USDCs.
Is the platform safe to use?
Yes. Our client's operations, security, and core activities continue without disruption. Users' security is our top priority, we checked all wallets and all recent activity to ensure everybody else’s safety.
How can I verify Request official smart contracts?
To ensure you are interacting with the correct contracts, always refer to our official smart contracts list here.
What measures are being taken?
Security is our top priority. As part of our continuous security improvements, we have:
Added additional safeguards and monitoring measures
Engaged an external, reputable cybersecurity firm to run frequent audits and penetration tests
Rotated all passwords and secrets used in the tech organization as a precaution
Additionally, we will:
Share an incident report once investigations conclude
Further reduce third-party dependencies
Optimize integrity checks and multi-sig wallet monitoring
How can I protect myself?
On your side, the best way to stay safe when interacting with Request (or any dapp) is to:
Keep your main treasury separate from the wallet you use for day-to-day payments
Whitelist only official Request Finance contracts (full list available here), if supported by your wallet provider
Always review the full contract address before approving a transaction
How can I get more information?
A detailed report is available here. For further information or enquiries, please contact us at [email protected].