Purrlend Exploit: DeFi Lender Loses $1.5 Million in Coordinated Dual-Network Attack

TLDR: Purrlend lost $1.5M across HyperEVM and MegaETH in a suspected coordinated dual-network exploit. HyperEVM bore the larger loss at $1.2M, while MegaETH accounted for roughly $324,000 in stolen funds. Stolen assets included USDC, USDT0, USDH, wstHYPE, kHYPE, WHYPE, UETH, WETH, and USDm tokens. April 2026 is on pace to rank among the worst months for crypto theft, with over $600M lost in 18 days. Purrlend, a decentralized lending and borrowing protocol built on HyperEVM, suffered a suspected exploit on April 25, 2026. The attack hit two separate networks simultaneously, HyperEVM and MegaETH. Combined losses reached approximately $1.5 million. The incident was first flagged by Kirby Ong, founder of HypurrCollective. Purrlend has since paused all protocol operations while its team investigates the breach. Attack Drains Funds Across Two Blockchain Networks The exploit targeted Purrlend on both HyperEVM and MegaETH in a coordinated dual-network attack. HyperEVM suffered the larger share of losses, with roughly $1.2 million drained from the protocol. MegaETH accounted for the remaining $324,549 in stolen funds. Kirby Ong, founder of HypurrCollective, was the first to raise the alarm on social media. He posted a detailed breakdown of stolen assets across both chains. His post read: “Purrlend appears to be exploited on both MegaETH and HyperEVM.” Purrlend appears to be exploited on both MegaETH and HyperEVM. Attacker made off with: 449,683.8748 $USDC214,125.3752 $USDT0194,745.1368 $USDH2.0477 $UBTC1,581.3418 $wstHYPE19.6052 $UETH868.4795 $kHYPE757.0228 $WHYPETotal: $1,197,488.33 on HyperEVM + 163,169.1587… pic.twitter.com/SgP4CsK4Ln — kirbycrypto (@kirbyongeo) April 25, 2026 The stolen assets on HyperEVM included nearly $450,000 in USDC and $214,000 in USDT0. The attacker also took close to $195,000 in USDH, along with wstHYPE, kHYPE, WHYPE, and UETH tokens. On MegaETH, the attacker withdrew $163,000 in USDT0, WETH, and USDm. Purrlend confirmed the incident shortly a...