What happened
On June 19, 2025, attackers drained about $65,000 from old, abandoned Bankroll Network staking contracts (BankrollNetworkStack and related versions) on BNB Chain and Ethereum. TenArmor counted this total across several attack transactions. It was Bankroll Network's second exploit, after a ~$235K loss in September 2024.
The contracts were compiled with Solidity 0.6.8, which does not revert on arithmetic overflow or underflow. SolidityScan traced the bug to sell(), which subtracts a signed _updatedPayouts value from payoutsTo_[_customerAddress] with no underflow check, corrupting dividend accounting. BlockSec Phalcon, reviewing the whole series of Bankroll attacks since September 2024, instead blamed an ordering flaw: distribute() updates the global profitPerShare_ only after a user's payouts are synced during buy and sell. Either way, a large buy followed by an immediate sell left the attacker credited with more dividends than it was owed, and it withdrew them.
Revoke.cash and SolidityScan warned that wallets which had once approved these contracts were at risk while the approvals stayed active, since the project was no longer maintained.
**Block data**
- BNB Chain attacker:
0x2dea406bb3bea68d6be8d9ef0071fdf63082fb52 - Ethereum attacker:
0x172dca3e72e4643ce8b7932f4947347c1e49ba6d - Vulnerable contract (BNB Chain):
0xAdEfb902CaB716B8043c5231ae9A50b8b4eE7c4e - BNB Chain attack transactions:
0x7226b3947c7e8651982e5bd777bca52d03ea31d19b515dec123595a4435ae22c,0x96a6a5ded6d652ec8a38804281fd99437f4cb3fcb4858ca0cf6c632eb34a40c4,0x0706425beba4b3f28d5a8af8be26287aa412d076828ec73d8003445c087af5fd - Ethereum attack transaction:
0x8905a0aca5849626c0de026c2d2894ddfa8060a27725221f01aac9fb0b3d6629
How it happened
- In the BNB Chain transaction
0x7226b394..., the attacker flash-swapped 2,000 WBNB from a PancakeSwap pair. - It called
donatePool()with 1,000 WBNB to fill the contract's dividend pool, thenbuy()with 240 WBNB to mint a large stake. - It immediately called
sell()on the whole stake. The unchecked payout bookkeeping during the sell left the attacker's position showing far more withdrawable dividends than it had earned. - It sent about 94 WBNB to the contract so it held enough to pay out, called
withdraw()to collect the inflated dividends, and repaid about 2,005.2 WBNB to the pair, netting about 24.5 WBNB. - Similar transactions against related Bankroll contracts on BNB Chain and Ethereum brought the total to about $65K.
Protocol details
Evidence
- report Post-mortem medium.com
- report TenArmor Security Alert on BankrollNetworkStack x.com
- report BlockSec Phalcon thread on Bankroll attack series x.com
- code DeFiHackLabs BankrollNetwork_exp.sol PoC github.com
- analysis DeFiLlama defillama.com
- analysis Bankroll Network Hack Analysis blog.solidityscan.com
- analysis 2025 Bankroll Network Hack: Check If You're Affected revoke.cash
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
