NovaBox's reward pool on Ethereum was hacked on June 9, resulting in the theft of approximately 56.73 ETH. The attack exploited a flaw in the platform's reward distribution mechanism, affecting over 130 depositors. Hackers drained the pool from 65.11 ETH to just 0.09 ETH in a single transaction, representing a loss of about 99.86% of the total funds. Security firm F12 clarified that the breach was not due to a smart contract vulnerability but a flaw in the dividend payout process. The attacker used a 427.5 WETH flash loan from Aave V3 to manipulate the system, creating a "phantom dividend" of 145.82 ETH by depositing a small amount of NOVA tokens to trigger dividend calculations, followed by a large ETH deposit. This manipulation allowed the hacker to receive dividends based on an inflated share, depleting the reward pool.