AquaDAO Hack

AquaDAO was exploited via proposal, which allowed the attacker to mint 100,000,000,000 $AQUA tokens.

AquaDAO is a DAO that aims to end the world water crisis. The project was built in the Cosmos SDK based layer-1 Juno chain. The DAO was exploited by the malicious actor, which took over AquaDAO and passed a proposal that minted 100,000,000,000 $AQUA tokens to the attacker. The attacker was able to take over the DAO cause he controlled 51% of the governance tokens because the AquaDAO team did not stake a needed amount of tokens to prevent such actions.

Consequently, the bad actor wiped out multiple $AQUA pools mostly on WYND DEX, Loop, and Kujira. Pools with $AQUA and the project-related token $CASA were removed from WYND DEX after some period. The total approved lost funds are 3,889 $ATOM which is worth 47,912 $USD at the moment.

Attacker addresses:

https://www.mintscan.io/juno/account/juno1matu8jgn3rmk2955j694qmj9w30nycaf49334r

Mint transaction:

https://www.mintscan.io/juno/txs/4338A591B461DCA7ADA2B138D10955EA51F47A5A32BCDDEC3D659425B9FA7898

Malicious proposal:

https://daodao.zone/dao/juno1zea8sewknejm2yqva89u7jd3kdngm3ahra3lxfnkvxju78ljyurqldl407/proposals/A2

Address holding funds:

https://www.mintscan.io/cosmos/account/cosmos1matu8jgn3rmk2955j694qmj9w30nycafrhj2jl