What happened
The attacker's address:
https://bscscan.com/address/0xfcf6738c…fc08f4
The example of transaction behind the attack:
https://bscscan.com/tx/0x8769f7ee…d6670f
The hack is made possible due to a profit inflation bug, which was exploited to donate a large amount of $NOVAs so that a huge amount of $JAWS tokens can be minted as a reward.
The attacker (based on the example tx):
- flash loaned 2.5K BNB
- swapped 569 BNB to 186.5K NOVA
- deposited 186.5K NOVA to Shiba's NOVA/WBNB LP
- called getReward() to swap 3.69e-06 NOVA to 561 BNB
- swapped 280 BNB to 3362 JAWS
- added liquidity with 280 BNB and 3362 JAWS into JAWS/WBNB LP, receiving 955 LP tokens
- minted 640,050 JAWS as a reward because of the inflated value of 955 JAWS/WBNB LP tokens
- called withdrawAll() to withdraw 640,050 JAWS
- swapped received JAWS to 509 BNB
Stolen funds were bridged into Ethereum. The attacker deposited ETH into Tornado Cash mixer:
https://etherscan.io/address/0xfcf6738c…fc08f4
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report twitter.com
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.