What happened
The ATM token on BNB Chain was drained for approximately $243K on June 3, 2026 through a permissionless reward-recycling and pool-accounting path.
Technical root cause
The legacy reward-recycling flow could be triggered without authorization and moved value into the AMM pair in a way that changed reserves and price without enforcing a safe state transition or cumulative extraction limit.
How it happened
- The attacker repeatedly called the permissionless burnExpiredReward path, which fed ATMToken.recycle and forced the ATM/USDT pool to synchronize at manipulated reserves.
- Thirty sybil wallets then sold ATM at the inflated price, extracting approximately 243K USDT.
Protocol details
Classification
Token / Protocol Logic
Protocol Type
Exploit/Other
Implementation language
Solidity
Evidence
Proofs of concept
2 availableSources
- report Twitter/X Alert x.com
- report @TenArmorAlert incident report x.com
- transaction ATM Token drain transaction bscscan.com
- analysis Website reference hacked.slowmist.io
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs ATM Token exploit replay raw.githubusercontent.com
- analysis SlowMist Hacked: ATM Token hacked.slowmist.io
- analysis anomly.rs — ATM Token recycle / burnExpiredReward exploit anomly.rs
- analysis Crypto Times — ATM Token exploit on BNB Chain cryptotimes.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
