Huma Finance v1 Contract on Polygon Exploited for 101,400 USDC

Huma Finance, a decentralized finance (DeFi) protocol, has experienced a security breach targeting its deprecated v1 BaseCreditPool contract on the Polygon network. On May 11, 2026, security monitoring firm Blockaid reported that attackers managed to siphon approximately 101,400 USDC and USDC.e from the legacy infrastructure. The incident has prompted an immediate response from the development team to secure the platform's assets and inform the community about the scope of the vulnerability.

Details of the Polygon Network Exploit

According to technical analysis, the exploit was localized strictly to the deprecated v1 smart contracts that the protocol had been in the process of decommissioning. The unauthorized transfer of stablecoins occurred via a specific vulnerability in the BaseCreditPool, a legacy component used for liquidity management during the platform's early stages on the Polygon blockchain.

In response to the breach, the Huma Finance team provided the following clarifications:

• The exploit specifically targeted v1 contracts; more recent versions are not at risk.
• The platform's v2 Solana system is a complete rewrite and remains fully operational.
• The protocol’s native PST token has not been impacted by the security event.
• Huma Finance does not hold user funds directly, which limited the potential scale of the theft.

Protocol Response and Mitigation Measures

Prior to the attack, the team had already initiated the phasing out of all v1 liquidity pools as part of their transition to more robust architecture. Following the detection of the exploit, the team moved to completely suspend the v1 contract to prevent further drainage. This proactive suspension ensures that no additional assets can be withdrawn through the identified flaw.

This vulnerability only affects its old v1 contract on Polygon. The v2 Solana system is a complete rewrite and is unaffected.

The distinction between the legacy code and the current Solana-based deployment is critical for users. Because the v2 codebase was developed independently of the original Polygon v1 structure, the security architectures are entirely separate.

While the loss of 101,400 USDC represents a setback for the legacy pool, the Huma Finance team emphasizes that the core of the current ecosystem remains secure. The incident serves as a reminder of the risks associated with deprecated smart contracts and the importance of complete decommissioning during protocol upgrades. Investors and liquidity providers are encouraged to verify that they are interacting exclusively with the audited v2 systems to ensure the safety of their digital assets.