What happened
BadgerDAO users lost about $120.3 million on December 2, 2021 after the delivery path for the protocol's web application was compromised. This was not a flaw in Badger's vault contracts. Malicious code served through Cloudflare Workers asked selected users to approve the attacker as an ERC-20 spender, allowing later allowance-based transfers from their wallets.
Control of trusted front-end delivery infrastructure allowed an attacker to alter sensitive wallet-transaction requests. The security failure was API-key and frontend-integrity control, combined with inadequate detection of suspicious spender approvals, rather than a vault authorization bug. Protocols must audit the transaction-building path and CDN deployment controls alongside contracts, including key scope, rotation, integrity monitoring, and alerts for one EOA receiving approvals across many tokens.
Case & protocol details
Attack Timeline
An unauthorized Cloudflare Workers API key was used to inject malicious script into Badger's front end. The injection was selective, targeting only part of the user base. When an affected user interacted with the dApp, the injected code added or substituted an ERC-20 approval naming the attacker-controlled address as spender.
The wallet signatures were valid approvals, so the attacker could use standard transferFrom paths to drain assets without exploiting a Badger vault contract. Badger paused contracts where possible, causing some later drain attempts to fail.
Funds Recovery
Recovered
$9.1M
Net Loss
$111,865,559
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report badger.com
- report PeckShield 2021 security report peckshield.com
- transaction Transaction etherscan.io
- analysis Website reference archive.is
- analysis BadgerDAO recovery phase oldlandingpage.badger.com
- analysis BadgerDAO turning the lights back on oldlandingpage.badger.com
- analysis Microsoft analysis of the BadgerDAO attack microsoft.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.