BitBay StableVault: The vault payout and the USDC trail

On October 9, 2026, BitBay’s StableVault on Polygon transferred 14,838.466608989136 DAI to a newly deployed contract. In the same transaction, that contract delivered 14,813.548248 USDC to the address that had deployed it. The USDC left that address 39 seconds later, passing through a MetaMask-labeled router to an unlabeled contract where the report’s incident trail stops.

SentinelTX assesses the transaction as a flash-liquidity-assisted vault accounting exploit, consistent with a reported flaw that allowed a full withdrawal when liquidity equaled zero. The recorded DAI payout and USDC receipt anchor that finding. Their conversion relationship is inferred, and the report does not decode the vault’s ABI or the conversion swap.

A later 4,156.374927 USDC receipt followed the same exit route. Its relationship to BitBay remains unresolved, so it is kept separate from the seed vault loss throughout this article. The receiving address’s total USDC activity is broader than the value attributed to the vault.

This article adapts “BitBay StableVault Incident — Polygon Investigation Report,” SentinelTX case CASE-ASYNCA99, dated October 12, 2026. All case findings and qualifications come from that PDF. Times are UTC, and the chain is Polygon PoS, chain ID 137. The report’s “verified” transfer status means the transfer was retrieved; it does not by itself establish who signed it or whether it was authorized.

Funding and deployment preceded the vault payout

At 02:00:17 on October 9, the starting externally owned account, or EOA, 0x59ae3c…e9884b, received 2,461.5991 MATIC from 0xc1d134…18a1b5. The report identifies this as the EOA’s only inbound native transfer on Polygon in the provider list it read to its end.

The funding contract is unlabeled in the consulted label database. A public-documentation search snippet associates the same address string with a Bridgers contract on Avalanche. SentinelTX treats this as a single-source lead consistent with a cross-chain payout. Its bridge check found no correlated source swap, leaving the funding chain and originating address unresolved.

The EOA’s first outgoing transaction, at 02:15:12, deployed 0x8eac46…330f43b. No subsequent EOA call to that contract appears in the transaction list. SentinelTX suggests it may have been a test or failed build; its purpose remains unresolved.

At 02:18:45, the EOA deployed the contract used in the incident, 0xc2c6f4…3c23e2. At 02:23:42, block 95204942, it called that contract with selector 0xde463630. This successful, zero-native-value call is the seed transaction for the report.

Within that transaction, BitBay’s vault 0x048e88…f2e5a0 paid 14,838.466608989136 DAI to the deployed contract, and the contract sent 14,813.548248 USDC to the EOA. These are different assets and different quantities. The report’s vault-loss figure is the DAI payout, rather than the USDC that reached the EOA.

The call sequence supports an accounting exploit assessment

The PDF cites press snippets reporting SlowMist’s account of the flaw: StableVault’s _withdraw() function permitted a full withdrawal when liquidity == 0. In that description, a zero-liquidity reading became permission to release the full position. The primary SlowMist X post is not quoted in the report.

SentinelTX’s recorded call tree contains 221 frames, reaches a maximum depth of 10, and has no revert. Its reconstruction proceeds through the following stages:

• Initial reads. The deployed contract reads the vault and its own DAI balance.
• First liquidity source. It calls Uniswap-labeled 0x5645dc…40a8cf, which transfers 106,411.49245613333 DAI to the deployed contract and calls back into it.
• Nested liquidity source. Inside that callback, it calls Balancer-labeled 0xba1222…6bf2c8, which supplies 1,453.5690015255825 DAI and makes another callback.
• Vault deposit. Within the nested callback, the deployed contract approves DAI and calls the vault. The vault pulls DAI, then interacts with Uniswap-labeled 0x673667…3e5cd6 through a session containing liquidity, take, settle and swap-type calls.
• Direct pool interaction. The deployed contract opens its own session with that same Uniswap-labeled address, including a USDC take and a DAI transfer.
• Vault withdrawal. It calls the vault again. The vault opens another pool session and receives DAI. The recorded seed movements include the vault’s 14,838.466608989136 DAI payout and the contract’s 14,813.548248 USDC payout to the EOA.

Other seed-transaction receipts into the deployed contract include 93,037.23599691519 DAI and 107,843.364597 USDC from 0x673667…3e5cd6. These larger execution flows are not the reported vault loss. Adding them to the DAI payout would mix liquidity used during execution with the value attributed to the affected vault.

SentinelTX assesses this as flash liquidity funding a vault deposit, followed by a direct change to the underlying position’s state and then a withdrawal. That sequence is consistent with the reported liquidity-zero flaw. The PDF leaves important parts undecoded: repayment to the liquidity sources, the vault ABI, and the swap connecting the extracted DAI to the USDC delivered to the EOA. The conversion is an inference from the observed amounts.

Diagram 1. The seed transaction on October 9, 2026 at 02:23:42 UTC. The PDF separates a press-reported liquidity-zero withdrawal flaw from the observed transfer of 14,838.466608989136 DAI from the vault to the exploit contract and 14,813.548248 USDC from the contract to the EOA. It treats the DAI-to-USDC conversion as an inference, not a decoded swap, and does not decode the repayment legs. Equal-width arrows indicate mechanism or transfer direction, not value.

Color key: Slate identifies the vault’s DAI payout; sage identifies the first-wave USDC delivered to the EOA. Neutral text shows the press-reported mechanism.

Address/role key: Vault = 0x048E88311ca84876aeA086125825492e2AF2e5A0; exploit contract = 0xc2c6f4f7e1425be1dcb996175cf7852bf53c23e2; EOA = 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B.

Source: SentinelTX, BitBay StableVault Incident — Polygon Investigation Report, CASE-ASYNCA99, October 12, 2026, pp. 8–9, §5 “Transaction Typology.”

The first USDC receipt left in 39 seconds

At 02:24:21, the EOA called 0x3a0b42…3d7a16, labeled MetaMask, immediately after an approval call to the USDC contract. The exit transaction moved 14,813.548248 USDC from the EOA to 0xfb7c74…86b025.

The report describes the recipient as an unlabeled, high-volume contract. A search snippet showing a fee event supplies a possible router or settlement-address lead, but no verified operator attribution. “MetaMask-labeled” describes the router label consulted by SentinelTX; the onward recipient is a separate address.

The incident’s USDC route is therefore established to that receiving contract. Its destination network and eventual recipient are not established. Bridge-correlation checks on the two USDC exits and the later MATIC exit found no correlated destination. SentinelTX assesses the pattern as typical of a swap-or-bridge exit, while retaining that unresolved boundary.

A later USDC receipt cannot be added to the BitBay loss

At 03:36:48, the same EOA deployed 0x5e5b9d…ad4606. Five calls with selector 0xbb2bd489 followed between 03:38:15 and 03:41:54.

At 03:42:59, block 95208113, another call to that contract produced 4,156.374927 USDC from the Uniswap-labeled 0x673667…3e5cd6 to the EOA. The transaction has 13 call frames involving the newly deployed contract, that Uniswap-labeled address, USDC and the unlabeled 0x3a9a81…20fc34. The BitBay vault does not appear in this call tree.

SentinelTX assesses the pattern as settlement of a position in 0x3a9a81…20fc34, possibly built by the five preceding calls. Whether that position represents BitBay value, a second victim’s assets or the operator’s own capital is unresolved.

At 03:43:27, the EOA forwarded all 4,156.374927 USDC through the same MetaMask-labeled router to the same receiving contract. The repeated route connects the activity operationally, but does not establish the source of the second receipt.

Figure 2. Two separately scoped USDC receipts at the same EOA on Polygon: 14,813.548248 USDC at 02:23:42 UTC and 4,156.374927 USDC at 03:42:59 UTC on October 9, 2026. Bars share a zero baseline and an axis measured in USDC. The later wave’s relationship to BitBay is unresolved; these receipts are not a combined BitBay loss total.

Color key: Sage identifies the first-wave USDC proceeds from the seed transaction; amber identifies the later USDC receipt whose BitBay relationship is unresolved.

Address/role key: EOA = 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B; first-wave sender = exploit contract 0xc2c6f4f7e1425be1dcb996175cf7852bf53c23e2; later-wave sender = Uniswap-labeled 0x67366782805870060151383f4bbff9dab53e5cd6.

Source: SentinelTX, BitBay StableVault Incident — Polygon Investigation Report, CASE-ASYNCA99, October 12, 2026, pp. 4–5, §1; p. 7, §3; p. 9, §5.

Keep the account totals separate from the loss

The report’s quantities describe different parts of the record:

• Seed vault loss: 14,838.466608989136 DAI, paid to the deployed seed contract.
• First EOA payout: 14,813.548248 USDC, received in the seed transaction and forwarded at 02:24:21.
• Later EOA payout: 4,156.374927 USDC, received at 03:42:59 and forwarded at 03:43:27, with its relationship to BitBay unresolved.
• Total EOA USDC movement: 18,969.923175 USDC received and 18,969.923175 USDC forwarded; net movement over the traced scope is 0. This is account-flow accounting, not an additional loss figure or a queried current balance.
• MATIC funding and disposal: 2,461.5991 MATIC received; 2,443.061934040620841817 MATIC sent to the MetaMask-labeled router at 03:43:51; 18.515648776563152138 MATIC spent as gas in the provider-listed rows.
• MATIC accounting remainder: 0.021517182816006045 MATIC, calculated as provider-list inflows minus outflows minus gas. Appendix A expressly says these provider-list totals are not a balance.

The PDF’s narrative and quantity summary print the seed loss as 14,838.466608989136 DAI. Its evidence table retains additional precision in the “Transfer amount” column: 14,838.466608989135865711 DAI. This article preserves the report’s narrative figure for the main finding and identifies the more precise table value here.

The whole recorded sequence runs from funding at 02:00:17 to the MATIC exit at 03:43:51, approximately 1 hour 44 minutes. The report finds no fund return, negotiation message or bounty transfer in the EOA history it describes. It identifies zero exchange deposits in the examined evidence, leaving any later exchange deposit or fiat cash-out undetermined.

The exit boundary defines the next useful evidence

The last receiving contract in a trace does not establish a final cash-out destination. At 0xfb7c74…86b025, the report records 4,467 rows read and left unwalked, a page limit and a provider page that did not answer. The router’s outbound read and the funder’s inbound read stopped at high-volume boundaries. These collection limits matter when interpreting the missing onward path.

SentinelTX prioritizes routing records for the three exit transactions. It recommends seeking the route adapter, destination network and recipient from the router operator, identifying the receiving contract’s operator, and obtaining settlement records for the two separate USDC legs. These are proposed next steps, not completed information requests or established recovery routes. No exchange freeze target is anchored in the report.

The funding lead is separate. SentinelTX recommends obtaining a source-chain record for the 2,461.5991 MATIC payment and examining the same address’s existing Relay history on Ethereum and BSC under a separate scope. The PDF records those cross-chain leads without linking their transaction hashes to the Polygon incident.

For wave 2, it recommends classifying 0x3a9a81…20fc34 and decoding the five preceding calls. For BitBay, it recommends pausing or deprecating the affected vault, auditing sibling vaults with the same liquidity-zero withdrawal logic, and publishing a post-mortem reconciling the full vault-side loss. The report does not contain the vault’s full token history, so loss in other transactions remains unresolved.

Figure 3. The PDF’s conclusion separates the seed-transaction loss of 14,838.466608989136 DAI from the traced USDC endpoint. The onward network and recipient are unknown. No exchange deposit is identified in the examined evidence; a later exchange deposit or cash-out remains undetermined. Wave 2’s relationship to BitBay is unresolved, and the full vault token history is outside the report. The priority next step shown is the report’s request for router routing records.

Color key: Slate marks section headings only; conclusions and limits are stated in text.

Address/role key: Unlabeled settlement contract = 0xfb7c744da69aef11dfb54f31d9db12a3b086b025; MetaMask-labeled router = 0x3a0b42ce6166abb05d30ddf12e726c95a83d7a16.

Source: SentinelTX, BitBay StableVault Incident — Polygon Investigation Report, CASE-ASYNCA99, October 12, 2026, pp. 12–13, §9 “Conclusion.”

Continue from the documented boundary

The useful continuation is to establish what happened beyond the two USDC exits while preserving the distinction between the seed loss and the later receipt. In SentinelTX, start from the seed transaction and the report’s unresolved routing boundary. A focused investigation prompt is:

Investigate the BitBay StableVault incident on Polygon PoS, chain ID 137, using transaction 0x5b795dc5c5e1665b712c7ccf478c1d8c59a162d698f4e0bfb40bd303e04a7ff2 and case CASE-ASYNCA99 as the October 12, 2026 baseline. State the query time, window and collection limits. Trace the onward destination of the two USDC exits, 0x397c0c95e3bea5966d9bec90bf752b7850809b8e82ff1b82b95d30011562f821 and 0xcc6be3077e62cba412d790e074e81030f4ecc188ff9d0f1408affb765d4dabb4, and the MATIC exit 0xa48e780331293f52ef5928ffeb29d5298d679861f1decc12289828ff1b96792c. Keep the 14,838.466608989136 DAI seed loss, 14,813.548248 USDC first payout and unresolved 4,156.374927 USDC wave separate. Can the route adapter, onward network and recipient be established, and what supports any exchange or bridge attribution? Distinguish retrieved transfers, decoded execution, assessments and provider-list accounting.

Source and scope

The sole factual source is the 20-page native SentinelTX PDF, “BitBay StableVault Incident — Polygon Investigation Report,” case CASE-ASYNCA99, dated October 12, 2026 and generated at 00:28:56 UTC. Its executed query windows span September 9 to October 12. The 11 retained movement rows run from October 9 at 02:00:17 to 03:43:51; a query window is not continuous transaction coverage.

The article follows the PDF’s incident quantities and explicit qualifications, rather than treating every edge in its figures as incident loss. The PDF warns that a drawn edge also totals other transfers between the same addresses. That aggregate is not used here.