Pool Party Exploit: $215K Drained From Arbitrum and Base Pools via Snapshot Flaw

Quick answer: Pool Party, a DeFi protocol that runs managed Uniswap v3 liquidity pools, lost about $215,000 from 15 pools on Arbitrum and Base on 13 November 2026. The attacker exploited a flaw in each pool's snapshot contract to withdraw more than they had deposited. The team says a fix is live. Users should check their positions and review approvals.

What is Pool Party?

Pool Party is a self-custodial DeFi protocol where users invest in Uniswap v3 liquidity positions run by named pool operators. Instead of managing concentrated liquidity ranges themselves, investors deposit into a pool and the operator manages the position. According to its security page, admin control sits with a multisig and upgrades go through a 4-day timelock. The same page says the protocol has no published third-party audit and no formal bug bounty programme.

Do not confuse it with joinpoolparty.io, which is an unrelated project.

What happened

According to SlowMist's incident entry and a technical write-up by auditor PandaSecurity, an attacker drained about $215,000 from 15 Pool Party pools on 13 November 2026. Twelve of the pools were on Arbitrum and three on Base.

How the exploit worked

Each Pool Party pool uses a snapshot contract to record how much each investor is entitled to. That contract exposes a function called syncInvestor. SlowMist classes the incident as a smart contract vulnerability. PandaSecurity's analysis says the attacker manipulated their recorded position through this function and then withdrew far more than they had put in.

On one Base pool, PandaSecurity traced seven addLiquidity deposits of 10 USDC each, 70 USDC in total. The attacker then withdrew about 12,066 USDC, a net gain of roughly 11,996 USDC. A per-pool breakdown for the Arbitrum pools has not been published.

The exact root-cause bug inside the snapshot logic has not been fully described in public yet. Pool Party's own thread on X is the primary source for the team's statements.

Timeline

• 01:34–03:38 UTC, 13 November: the attacker drains funds from 15 pools, according to PandaSecurity.
• 04:58 UTC: Pool Party says 115,056.36 DAI from the incident reached a wallet through CCE Cash.
• 18:13 UTC: the team posts an on-chain message on Arbitrum offering the attacker a bounty. The attacker would keep 10% of the remaining roughly $193,500, return the rest, and face no legal action.
• 18:23 UTC: Pool Party publishes its official incident thread.

The team says the attacker converted funds to Monero (XMR). It also says it has reported the incident to law enforcement and exchanges and is working with SEAL 911 and security researcher pcaversaccio, according to a summary on dev.to.

Who is affected

Investors in the 15 affected pools

If you held a position in one of the affected Arbitrum or Base pools, your share of that pool's assets may have been reduced. Pool Party had not published a list of affected pools, a per-user loss figure or a reimbursement plan as of 14 November.

Pool Party users on other chains

The team says pools on Polygon and Robinhood Chain were not affected. The protocol's site also lists Ethereum. Check your own pool's status in the official interface rather than assuming.

Pool operators

Operators of affected pools should expect questions from investors and should point them only to official Pool Party channels for updates.

How to check your exposure

1. Open the official interface from a bookmark. Check your pool positions and balances. Avoid links shared in replies, DMs or search ads.

2. Look up your wallet on a block explorer. On Arbiscan or BaseScan, review recent transactions involving Pool Party contracts. Look for any withdrawals you did not make.

3. Compare against the attacker's address. The address published in the incident write-ups is 0x2075c17abbd077cf6406736bb7047ed446ab7f8f. You can view its activity on BaseScan. Do not send funds to it or interact with it.

4. Record your position. Screenshot your pool balances and note your deposit history in case a reimbursement process is announced.

5. Wait for the post-mortem. The team has not yet published a full root-cause analysis or a compensation plan. Follow only official announcements.

Should you revoke approvals?

SlowMist and PandaSecurity describe this as an accounting flaw inside the protocol's snapshot contract. Nothing published so far shows that the attacker spent tokens directly from users' wallets through approvals. Even so, reviewing approvals is good practice after any exploit:

• Use a reputable approval checker to see which contracts can spend your tokens on Arbitrum and Base.
• Revoke unlimited approvals to Pool Party contracts you are no longer using.
• Keep approvals scoped to exact amounts in future where your wallet allows it.

Our guide to revoking token approvals after the Across domain hijack walks through the process step by step.

What to avoid

• Depositing into affected pools before the team confirms they are safe. A fix being live is not the same as a published post-mortem.
• Trusting "recovery services" that promise to retrieve your funds for an upfront fee. These are scams.
• Interacting with the attacker's address or with tokens it sends you. Unexpected tokens can be bait for phishing sites.
• Assuming an unaudited protocol is safe because it uses audited components. Pool Party builds on Uniswap v3, but the snapshot contract was its own code.

The bigger lesson: accounting bugs in DeFi wrappers

This incident follows a pattern seen in other recent exploits, where the base protocol worked as designed but a wrapper's internal accounting could be manipulated. We saw something similar in the Arcus subaccount accounting bug and the Rujira exploit on THORChain. Before depositing into any managed pool or vault, check whether its own contracts have a published audit, whether there is a bug bounty, and how quickly admins can pause it in an emergency.

Frequently asked questions

Conclusion

The Pool Party exploit is a reminder that managed liquidity products add their own smart contract risk on top of the protocols they use. If you invested in an affected Arbitrum or Base pool, record your position, check your wallet history on a block explorer, tidy up approvals and wait for the official post-mortem before acting. Ignore anyone who claims to offer a refund or claim link.

This article is for general information and education only and is not financial, legal or security advice. The Onchain Support is an independent publication and is not affiliated with Pool Party, Uniswap, SlowMist, PandaSecurity or any exchange. We never ask for seed phrases, private keys, passwords or 2FA codes.