On October 9, 2026, an attacker deployed a malicious contract on Berachain aimed at BeraFarm. Hypernative's ML models scored the deployment High for maliciousness and within seconds, an automated pause fired on Kodiak, a Hypernative customer. BeraFarm's attack path ran through Kodiak's contracts, so the pause stopped the exploit before it started. Simulation shows that at least $250K was saved.
BeraFarm is not a Hypernative customer and never received an alert. The team paused its own contracts in time, with support from Hypernative and Kodiak, and confirmed in its post-mortem that no user funds were lost. Deposits and withdrawals remained paused while the team investigated, and at the time of publication had opened again with the protocol back to normal operation.
The save shows how Hypernative's deployments protect not only our customers but the wider network. Kodiak trusted our detection enough to connect it to a pause across all of its Islands, a decision that protected a protocol that was never part of the loop.
We use Hypernative to catch 'hacks before they happen.' As part of our real-time security monitoring strategy, Kodiak Islands are configured to automatically pause all islands in case malicious activity is detected in any one of them.
Berastotle, CTO at Kodiak
The save happened on Berachain, where Hypernative has established relationships across the chain to protect the protocols that build on it.
Read more about Hypernative's ecosystem protection.
The deployment
On October 9, a wallet funded through Tornado Cash deployed an exploit contract on Berachain at 20:29 UTC. Seconds later, Hypernative's potential-targets detection fired, and went on to raise an additional 12 Risk Insights on that single transaction. In the same minute a pre-configured automated response fired a Hypernative-controlled address called pauseAllIslands() on Kodiak's contracts, and the transaction emitted a Paused event from each of the 38 contracts.
At 20:31 UTC, Hypernative's AI triage agent returned its own verdict on the contract confirming the exploit with high confidence.
The attacker then tried again at 20:34 UTC with a rebuilt version of the contract deployed with the Kodiak addresses removed from its code. Hypernative’s detections fired again the same way and it never executed. The pause blocked it anyway, because its attack path deposits into BeraFarm's vault, which mints into a paused Kodiak Island. At 20:53 UTC, the attacker called a BeraFarm token directly, and a custom Hypernative agent flagged that too.
Alerts after the fact are cheap. Prevention is hard, because acting automatically takes high conviction and very little noise. We are the only vendor running automated prevention with zero humans in the loop, and customers only wire a pause to a detection once it has earned that trust. We are grateful for the trust Kodiak placed in us and in this instance that trust had network effects that reached BeraFarm and kept its users’ funds safe.
Dan Caspi, CTO, Hypernative
Berastotle reproduced the attack in Tenderly and found that it executes against the block before the pause and fails after it. Hypernative's own replay of the first exploit contract against archived Berachain state shows the same result with all simulations pointing to a prevented loss at ~$250K should the exploit have succeeded.
Kodiak's pause held for more than 11 hours, until BeraFarm paused its own protocol at 07:50 UTC on October 10. Kodiak unpaused its Islands at 08:58 UTC on October 10 with BeraFarm deploying its fix about three minutes later and finally llifting its own pause at 10:10 UTC on October 11, and the protocol resumed. BeraFarm's post-mortem explained that a flaw in how its hub reward vault accounted for balances allowed a third-party delegated stake to inflate a strategy's reported balance. That inflated the vault's net asset value, which flowed into the junior (Alpha) rate where the attacker's contract was built to exploit. BeraFarm verified the fix on a fork and deployed it, and the reported balance now excludes delegated stake. With the fix in place, replays of the exploit fail on the attacker contract's own preflight check, so the protection no longer depends on a pause.
About Kodiak
Kodiak is a decentralized liquidity platform, empowering users to seamlessly launch, trade, and provide liquidity for any asset. Kodiak DEX provides a non-custodial Automated Market Maker and Kodiak Islands is a Automated Liquidity Manager with set-and-forget strategy vaults. Learn more about Kodiak on kodiak.finance
About BeraFarm
Berafarm is an on-chain asset manager on Berachain that actively routes deposits across top protocols with risk-tranched vaults.
About Hypernative
Hypernative is a real-time monitoring, risk detection and automated response platform. It identifies threats with high accuracy and gives customers minutes to respond before exploits can do damage. The platform tracks onchain and offchain data and uses machine learning models, heuristics, simulations and graph-based detections to identify over 300 risk types.
Reach out for a demo, or follow Hypernative's blog for the latest on Web3 security.
.avif)
