QiDao Superfluid Contract Exploit: What Happened in 2026

The QiDao exploit is one of the better-known DeFi losses involving a contract that interacted with Superfluid, a money streaming protocol. The loss was reported at roughly $13 million. QiDao is a multi-chain CDP protocol where users lock crypto collateral and borrow a stablecoin against it. The incident was reported as affecting a deployment on Polygon.

An exploit like this means an attacker found a way to make a smart contract do something its designers did not intend, usually by moving or withdrawing assets it should have protected. In DeFi, the code is public and runs automatically, so a single flawed assumption can be used repeatedly until funds are gone.

This article is an evergreen explainer. It covers what the event was, what the public record does and does not confirm, how exploits of this type usually work, and what readers can do to check their own exposure. It does not give a complete technical root cause, because the sources available for this page did not establish one with confidence. For the authoritative account, read the protocol's own post-mortem and the independent analysis that followed.

Public reporting gathered for this page did not cover the QiDao incident. They included unrelated news about funding rounds, forfeiture cases, market commentary and a Lido lawsuit. None of them confirmed the mechanics of the attack, the exact contracts involved, the final amount recovered, or any legal outcome.

That gap matters. Loss figures for exploits are often revised as analysts trace transactions, and early reports can differ from later ones. Treat any single number, including the widely cited figure of about $13 million, as a starting point rather than a settled fact.

When you verify an incident, separate three kinds of statements:

• Facts confirmed by the protocol, such as which chain and contracts were affected
• Estimates from analytics providers, which may change as more data arrives
• Commentary or speculation about motive or attacker identity

Only the first category should guide decisions about your own funds. For the others, look for consistent figures across several sources and note when they were published.

Most DeFi exploits fall into a few broad groups. Understanding them helps you judge a new incident quickly, even without the full technical report.

Common patterns include:

• Logic errors, where a function does not check a condition it should, letting a user take more than they deposited
• Oracle manipulation, where a price feed is pushed off its true value so collateral looks worth more than it is
• Access control gaps, where an administrative or upgrade function can be called by anyone
• Integration risk, where one contract trusts the behaviour of another, and that second contract changes or fails
• Flash loan amplification, where an attacker borrows a large sum within a single transaction to exploit a weakness

A CDP protocol like QiDao is especially sensitive to collateral accounting and the stablecoin minting rules. A streaming protocol like Superfluid is sensitive to how balances flow between accounts over time. When two systems are connected, an assumption made by one can break the other, which is why integration risk shows up so often in post-mortems.

Whatever the exact method in any given case, the lesson is similar: an attacker looks for the gap between what a contract was meant to allow and what it actually permits.

Many users interact with several DeFi apps at once. They might deposit collateral in one protocol, borrow a stablecoin, send that stablecoin through a bridge, and then stake or lend it elsewhere. Each step adds a contract that must work correctly and a set of permissions that stays in place after the transaction ends.

This is why an incident in one protocol can reach others. A shared token, a common dependency, or an integration that routes funds through a second protocol can spread exposure. Users are often not aware that a front end they used depends on a contract they never looked at.

Risk concentration is also a factor. If a stablecoin or a collateral asset is used across many platforms, a problem with it can affect all of them at once. Checking which protocols depend on a token or contract is a practical part of managing exposure.

The point is not to avoid all connected protocols. It is to know which of your funds sit behind which contracts, and to reduce the number of places where you have permissions that you do not actively need.

If you think you used a protocol that was affected, begin with official sources. The protocol's website, verified social accounts and documentation should state which deployments were involved and what steps it recommends. Be careful with copies of these announcements, since scam sites often mimic them.

Next, check your own on-chain history. Use a block explorer for the chain in question and search your wallet address. Look for:

• Interactions with the contract addresses named in official notices
• Token approvals granted to those contracts
• Recent transfers out of positions you held
• Any position you still hold that the protocol has paused or marked as affected

A few practical points help here. Check each chain separately, since the same protocol can be deployed on several networks with different contracts. Note the date of each transaction, because announcements may cover only a specific window. Keep a record of what you find, including transaction hashes, in case you need to ask the protocol or an exchange for help.

If the record is unclear, wait for the protocol's confirmed guidance rather than acting on guesses.

Verifying exposure is useful, but preventing loss is better. The following habits reduce risk across most DeFi use, whether or not a specific exploit is in the news.

• Use a separate wallet for experimental or high-risk activity, and keep long-term holdings in a different wallet
• Approve only the amount you need, where the interface allows it, instead of unlimited spending
• Revoke approvals you no longer use
• Check the contract address against the official source each time, not against a link in a message
• Keep only what you can afford to lose in newer or less-audited protocols
• Read the transaction preview in your wallet, including the spender and the amount
• Keep your seed phrase offline and never type it into a website

Audits lower risk but do not remove it. A protocol can be audited and still fail in an untested scenario. Treat audit reports as one input, alongside how long a protocol has run, how much value it holds, how it handles upgrades, and whether it has a responsive security contact.

No setup removes all risk. The aim is to limit how much a single mistake or single failure can take from you.

A token approval lets a contract move tokens from your wallet. Old approvals can remain active long after you stop using an app, and a flaw in that contract can then put those tokens at risk. Revoking unused approvals is one of the most effective defensive steps available.

A general process looks like this:

1. Open a reputable approval management tool or your wallet's built-in approval view, and connect the wallet you want to check
2. Select the chain you want to review, since approvals are chain-specific
3. List the approvals and note the token, spender contract and amount
4. Match spenders you do not recognise, or that belong to protocols you no longer use, against the official addresses
5. Revoke each approval you do not need, paying the network fee when prompted
6. Recheck the list after a few hours to confirm the revocations went through

Take care with the tool you use. Some approval checkers ask you to sign messages or connect in ways that create new risk. Check the site address carefully, and never enter your seed phrase.

Revoking an approval for a protocol you still use may stop it from working until you approve again. Make that decision deliberately.

Incidents attract opportunists. After a widely reported loss, scammers often send messages offering to recover funds, claim to be investigators, or invite victims into a support group. Many of these approaches are designed to collect more money or access to wallets.

Watch for these signs:

• Unsolicited direct messages from accounts claiming to represent the protocol or a security firm
• Requests for a seed phrase, private key or remote access to your computer
• Fees, deposits or "gas" payments demanded before any recovery work begins
• Links to sites with urgent deadlines or slightly misspelled domain names
• Promises of guaranteed recovery of a fixed percentage

A real protocol team does not need your seed phrase to help you. If you are contacted, go to the official website or social account you already know, and confirm the message independently. Do not reply to the sender with wallet details.

If you have already sent funds or shared a seed phrase, move any remaining assets to a new wallet you control as soon as possible, then report the activity to the relevant exchange, payment provider or local authority.

If you believe your funds were involved in an exploit, act methodically. Speed matters, but so does avoiding new mistakes.

1. Stop interacting with the affected protocol and any front end that links to it
2. Save transaction hashes, wallet addresses, screenshots and the dates you used the app
3. Read the official announcement for instructions, including any claims process or deadlines
4. Revoke approvals to the affected contracts from the wallets involved
5. If you hold a related token, check whether it has been paused or changed, and read official notes before trading
6. If you use a centralised exchange, contact its support team with your records if funds passed through it
7. Consider speaking with a qualified adviser or lawyer in your jurisdiction if the sums are significant

Recovery is not guaranteed. Some funds are never returned, and some protocols offer partial compensation only through governance or insurance programmes with strict conditions. Tax treatment of losses varies by country, so keep your records in case you need them later.

In all cases, check the rules that apply where you live before taking legal or financial steps, and avoid any service that asks you to bypass identity checks or location rules.