Synapse 2021 nUSD metapool exploit
An attacker manipulated the Avalanche nUSD metapool virtual price by approximately 12.5% through a bug in the Saddle-derived metapool implementation. The attacker attempted to move approximately $8.2 million in nUSD through the bridge while validators were offline; the malicious transaction was not processed and affected liquidity providers were to be made whole.
Incident facts
- Incident title
- Synapse 2021 nUSD metapool exploit
- Bridge
- Synapse Protocol
- Incident date
- 2021-11-06
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Avalanche, Unknown
- Affected assets
- nUSD, USDC, Unknown
- Attack category
- Metapool Virtual Price Bug
- Reported loss
- No ultimate fund loss reported; approximately $8.2 million nUSD protected
- Amount confidence
- High
- Loss amount basis
- Official Synapse Postmortem
- Recovery
- Funds Protected
- Reimbursement
- In Progress
- Restart
- Reopened
- Current outcome
- Active After Incident
- Postmortem
- Full
- Resolution
- Unresolved
- Last reviewed
- 2026-06-15
- Last verified
- 2026-06-15
Amount and valuation
Synapse stated that no funds were ultimately lost because validators did not process the attacker's approximately $8.2 million nUSD bridge transaction.
Approximately $8.2 million is the protected malicious transfer amount, not realized user loss.
Why this remains unresolved
- The official postmortem said Avalanche nUSD liquidity providers would be made whole, but final distribution completion is not independently established in this batch.
Timeline events
Synapse paused metapools, AMM, and bridge after nUSD manipulation2021-11-06
Synapse identified abnormal nUSD metapool pricing, paused pools across six chains, and coordinated validators to go offline.
The bug was in the Saddle-derived metapool implementation, not the core bridge contracts.
Approximately $8.2 million nUSD transfer left unprocessed2021-11-06
Validators did not process the attacker's approximately $8.2 million nUSD bridge transaction, preserving the funds for affected liquidity providers.
The protected amount is not realized protocol or user loss.
Synapse restored the bridge and began pool migration2021-11-07
New pools were deployed, validators returned online, pending transactions were processed, and migration away from the vulnerable metapool design began.
Final liquidity-provider distribution completion remains unverified. Event type normalized from legacy descriptive value bridge_restored_and_liquidity_migration_started.
Evidence records
- 11/06/2021: Post-mortem of nUSD Metapool ExploitSynapse Protocol · Tier 1 · High reliability · primary · 2021-11-10Claim scope: Incident Case
Primary technical timeline and outcome account.
- Explained: The Synapse and Nerve Bridge HacksHalborn · Tier 2 · High reliability · secondary · 2021-11-24Claim scope: Incident Case
Independent context; Synapse and the separate Nerve Bridge remain distinct.
- 11/06/2021: Post-mortem of nUSD Metapool ExploitSynapse Protocol · Tier 1 · High reliability · primary · 2021-11-10Claim scope: Restart
Event-scoped duplicate supporting validator restoration, transaction processing, and pool migration.
- 11/06/2021: Post-mortem of nUSD Metapool ExploitSynapse Protocol · Tier 1 · High reliability · primary · 2021-11-10Claim scope: Incident Case
Event-scoped primary copy supporting validator rejection of the malicious nUSD bridge transaction and preservation of affected LP funds.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- Final liquidity-provider distribution completion is unverified.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.