---
title: "Ociswap Flex Pool Exploit (October 2026)"
url: "https://radix.wiki/contents/history/ociswap-flex-pool-exploit-2026"
updated: 2026-10-27
license: CC-BY-4.0
license_url: "https://creativecommons.org/licenses/by/4.0/"
version: "1.0.0"
---

# Ociswap Flex Pool Exploit (October 2026)

|  |  |
| --- | --- |
| **Date** | 27 October 2026, 06:32 UTC |
| **Network** | Radix mainnet |
| **Transaction** | [txid_rdx1l9nas…q4h93](https://dashboard.radixscan.io/transaction/txid_rdx1l9nasf02z2khlq2y8nfpxnnjxs6pat72sq0sa6swfph5xh87vemqzq4h93/summary), one manifest |
| **Pool** | [Ociswap Flex Pool ASTRL/XRD](https://dashboard.radixdlt.com/component/component_rdx1czrks23pt35cmapgt9amv6haxagpzds5pdqp6jxt97dm2azrtxvdch) |
| **Taken** | 1,139,873 $XRD |
| **Exit** | Hyperlane’s XRD warp route to Ethereum, 08:02 UTC |
| **Status** | [Ociswap investigating](https://t.me/ociswap/245775); no cause published |

On 27 October 2026 one transaction took 1.14m $XRD out of the ASTRL/XRD Flex Pool on [Ociswap](/ecosystem/ociswap), a decentralized exchange on Radix, by way of the pool’s own flash-loan method. ASTRL is the token of [Astrolescent](/ecosystem/astrolescent), a Radix exchange aggregator. A flash loan lends tokens that must be repaid before the transaction that borrowed them finalizes, or the whole transaction fails. The attacker borrowed, swapped and repaid inside a single manifest, and 90 minutes later sent the proceeds to Ethereum over [Hyperlane](/ecosystem/hyperlane).

## What the ledger shows

The transaction, [txid_rdx1l9nas…q4h93](https://dashboard.radixscan.io/transaction/txid_rdx1l9nasf02z2khlq2y8nfpxnnjxs6pat72sq0sa6swfph5xh87vemqzq4h93/summary), committed at 06:32 UTC. Its manifest makes these calls in order:

1. It borrows 1,200 $XRD by flash loan from Ociswap’s [fUSD/XRD Pool V2](https://dashboard.radixdlt.com/component/component_rdx1cpmacy5gwzswse56jprvlfhrpnt3mplswupu7qtq8pdz2hywy5uaqd) and swaps them for [ASTRL](https://dashboard.radixdlt.com/resource/resource_rdx1t4tjx4g3qzd98nayqxm7qdpj0a0u8ns6a0jrchq49dyfevgh6u0gj3) in [a second Ociswap pool](https://dashboard.radixdlt.com/component/component_rdx1cq7tc2pgyzawwjp4qf7ddfeq36scmkghmgl7ww4zp9tqpjuc452mp7).
2. It borrows 160,984 ASTRL by flash loan from the ASTRL/XRD Flex Pool itself.
3. With that loan still open, it swaps 7 ASTRL into the same Flex Pool, which pays out 1,140,952 $XRD.
4. It repays the ASTRL loan with 161,128 ASTRL, 145 more than it borrowed.
5. It swaps the ASTRL left over back to $XRD in the second pool and repays the first loan with 1,201.08 $XRD.

The difference stays in the attacker’s account, [account_rdx1286x…gvnu30](https://dashboard.radixdlt.com/account/account_rdx1286x38x9xntscsswf6nkn828axutptywt667vlcg7yndsm74gvnu30). Read from the Radix Gateway at 08:10 UTC, the Flex Pool held 7,680 $XRD and 1,163 ASTRL. The account’s only earlier transaction was [a deposit of 10.1 $XRD](https://dashboard.radixscan.io/transaction/txid_rdx1a7ym2ue4qjkc72vq4dlq0wfaye25knrv3n3vl302kdjl4xmlz8ws9jfnhc/summary) on 26 October.

The manifest records the order of the calls and the amounts. It does not show why the pool priced a 7 ASTRL swap at 1.14m $XRD while its own ASTRL was on loan; that is in the pool’s code, and Ociswap has not yet published a cause.

## Where the $XRD went

At 08:02 UTC the account withdrew 1,139,495 $XRD in [txid_rdx1jmqpk…qaqd5](https://dashboard.radixscan.io/transaction/txid_rdx1jmqpkdnpmc87mwy2hkltlpar3vnz5vve9uwwgps6w543ahpznynq7qaqd5/summary) and called `transfer_remote` on [Hyperlane’s XRD warp route](https://dashboard.radixdlt.com/component/component_rdx1crrj42g0855jnpvfs6t9tff25vtq3lm292g3h07xrnz9l49mnsu3hy), with destination domain `1`, which is [Ethereum](https://github.com/hyperlane-xyz/hyperlane-registry/blob/main/chains/ethereum/metadata.yaml), and a twenty-byte EVM recipient ending `a8d1`. It paid 380.04 $XRD in interchain gas. The same route carried the proceeds of the [August 2026 asset drain](/contents/history/hyperlane-asset-drain-2026) out of Radix.

## What happens next

At 06:54 UTC a member of Ociswap’s Telegram group [posted the transaction](https://t.me/ociswap/245773), warned that every Flex Pool was exposed and told liquidity providers to withdraw. Florian Pieper of Ociswap [replied at 08:04 UTC](https://t.me/ociswap/245775) that he was looking into it. Ociswap has not yet said whether other Flex Pools are exposed or whether liquidity providers will be compensated; this page will carry its statement when it is published.

## External links

- [The exploit transaction on RadixScan](https://dashboard.radixscan.io/transaction/txid_rdx1l9nasf02z2khlq2y8nfpxnnjxs6pat72sq0sa6swfph5xh87vemqzq4h93/summary)
- [The Hyperlane transfer on RadixScan](https://dashboard.radixscan.io/transaction/txid_rdx1jmqpkdnpmc87mwy2hkltlpar3vnz5vve9uwwgps6w543ahpznynq7qaqd5/summary)
- [Ociswap on Telegram](https://t.me/ociswap)
- [ociswap.com](https://ociswap.com)