Ociswap Flex Pool Exploit (October 2026)

On 27 October 2026 one transaction took 1.14m $XRD out of the ASTRL/XRD Flex Pool on Ociswap, a decentralized exchange on Radix, by way of the pool’s own flash-loan method. ASTRL is the token of Astrolescent, a Radix exchange aggregator. A flash loan lends tokens that must be repaid before the transaction that borrowed them finalizes, or the whole transaction fails. The attacker borrowed, swapped and repaid inside a single manifest, and 90 minutes later sent the proceeds to Ethereum over Hyperlane.

What the ledger shows

The transaction, txid_rdx1l9nas…q4h93, committed at 06:32 UTC. Its manifest makes these calls in order:

1. It borrows 1,200 $XRD by flash loan from Ociswap’s fUSD/XRD Pool V2 and swaps them for ASTRL in a second Ociswap pool.

2. It borrows 160,984 ASTRL by flash loan from the ASTRL/XRD Flex Pool itself.

3. With that loan still open, it swaps 7 ASTRL into the same Flex Pool, which pays out 1,140,952 $XRD.

4. It repays the ASTRL loan with 161,128 ASTRL, 145 more than it borrowed.

5. It swaps the ASTRL left over back to $XRD in the second pool and repays the first loan with 1,201.08 $XRD.

The difference stays in the attacker’s account, account_rdx1286x…gvnu30. Read from the Radix Gateway at 08:10 UTC, the Flex Pool held 7,680 $XRD and 1,163 ASTRL. The account’s only earlier transaction was a deposit of 10.1 $XRD on 26 October.

The manifest records the order of the calls and the amounts. It does not show why the pool priced a 7 ASTRL swap at 1.14m $XRD while its own ASTRL was on loan; that is in the pool’s code, and Ociswap has not yet published a cause.

Where the $XRD went

At 08:02 UTC the account withdrew 1,139,495 $XRD in txid_rdx1jmqpk…qaqd5 and called transfer_remote on Hyperlane’s XRD warp route, with destination domain 1, which is Ethereum, and a twenty-byte EVM recipient ending a8d1. It paid 380.04 $XRD in interchain gas. The same route carried the proceeds of the August 2026 asset drain out of Radix.

What happens next

At 06:54 UTC a member of Ociswap’s Telegram group posted the transaction, warned that every Flex Pool was exposed and told liquidity providers to withdraw. Florian Pieper of Ociswap replied at 08:04 UTC that he was looking into it. Ociswap has not yet said whether other Flex Pools are exposed or whether liquidity providers will be compensated; this page will carry its statement when it is published.

External links

• The exploit transaction on RadixScan
• The Hyperlane transfer on RadixScan
• Ociswap on Telegram
• ociswap.com