DeFi protocol WealthManagementV2 has lost 26,414 USDT after an attacker gained administrative control of its smart contract, with investigators pointing to a suspected private key compromise. The incident allowed the attacker to assume owner privileges and alter critical protocol parameters, creating a path to extract funds through manipulated investment and redemption activity.
According to an official alert from SlowMist, the attacker likely obtained access through a leaked private key before taking control of the contract at 0x7b5dda5135811ec0870a75a04d0e1807edc3c93d. SlowMist identified the unauthorized ownership transfer as the central security event behind the approximately $26,000 loss.
🚨SlowMist TI Alert🚨
💸 WealthManagementV2 Loss: 26,414 USDT
🔍 Root Cause: The owner privileges of the victimized contract were suspected of being illegally transferred (possibly due to a leaked private key). The new owner (attacker-controlled) can instantly set plan…
— SlowMist (@SlowMist_Team) September 8, 2026
Attacker Exploits Missing Timelock
After gaining control, the attacker modified the protocol’s plan parameters to extreme values. Those changes could take effect immediately because WealthManagementV2 did not use a timelock for privileged administrative actions, removing a potential delay that could otherwise have given operators or users time to respond.
The altered configuration allowed the new owner to generate unusually large interest amounts through repeated investment and redemption operations. The exploit therefore combined compromised administrative access with weak governance safeguards, rather than relying solely on an isolated flaw in ordinary user-facing contract functionality.
SlowMist identified the attacker-controlled externally owned account as 0xe439422afdd247503f75b4143c4a973eced04a36. Additional transaction information and the security firm’s root-cause assessment are available through its incident database. The published on-chain trail provides visibility into the ownership change and subsequent fund movements tied to the attack.
Recovery Plan Remains Unclear
The suspected private key leak remains an attribution based on SlowMist’s analysis rather than a publicly confirmed disclosure from WealthManagementV2. No detailed statement from the protocol has yet established how the administrative credential was exposed, leaving the precise compromise mechanism subject to further investigation.
Market activity around WealthManagementV2 has since effectively stalled, with trackers reporting no current trading volume. The lack of activity suggests the incident has materially disrupted use of the protocol, although the available information does not establish whether affected contracts have been permanently disabled or simply abandoned by users.
WealthManagementV2 has not announced a recovery plan or provided details about potential reimbursement for the 26,414 USDT loss. The incident highlights the risk of combining powerful owner permissions with immediate parameter changes, particularly when a single compromised key can alter protocol economics without a timelock or other delay mechanism.