What happened
AquaDAO was exploited via proposal, which allowed the attacker to mint 100,000,000,000 $AQUA tokens.
AquaDAO is a DAO that aims to end the world water crisis. The project was built in the Cosmos SDK based layer-1 Juno chain. The DAO was exploited by the malicious actor, which took over AquaDAO and passed a proposal that minted 100,000,000,000 $AQUA tokens to the attacker. The attacker was able to take over the DAO cause he controlled 51% of the governance tokens because the AquaDAO team did not stake a needed amount of tokens to prevent such actions.
Consequently, the bad actor wiped out multiple $AQUA pools mostly on WYND DEX, Loop, and Kujira. Pools with $AQUA and the project-related token $CASA were removed from WYND DEX after some period. The total approved lost funds are 3,889 $ATOM which is worth 47,912 $USD at the moment.
Attacker addresses:
Mint transaction:
Malicious proposal:
Address holding funds:
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
