---
id: 5385
title: "VirtuSwap Stealing funds using virtual pools with multicall BugFix review"
source_domain: hackenproof.com
source_url: "https://hackenproof.com/blog/virtuswap-vulnerability-exploitation-analysis"
published_at: "2026-06-11 10:10"
tags: ["web3", "vulnerability-research", "defi", "dex", "hackenproof", "defi-security", "bugfix-review", "virtuswap", "multicall"]
phying_url: "https://phying.com/item/5385"
lang: en
---

# VirtuSwap Stealing funds using virtual pools with multicall BugFix review

## Summary

A bugfix review of VirtuSwap: repeating swaps via multicall in a single block desynchronized virtual pool balances, letting an attacker skew rates and steal funds — up to two-thirds of assets.

## Intelligence Metadata

- **Sources:** hackenproof.com
- **Published:** 2026-06-11 10:10
- **Original:** https://hackenproof.com/blog/virtuswap-vulnerability-exploitation-analysis
- **Phying News:** https://phying.com/item/5385