BasketDAO Hack

On January 17, 2024, an attacker used BasketDAO's BMIZapper periphery contract to steal 114,146 USDC from one user who had approved USDC to the zapper. The attacker swapped it for 44.79 WETH, paid 2.24 ETH to a block builder, and kept 42.55 ETH (about $107,000, the figure BlockSec reported). BlockSec traced the theft to a transferFrom issue caused by arbitrary low-level calls in the BasketDAO contract and told users to revoke their approvals to it.

The attacker address 0x63136677355840F26c0695dD6DE5C9E4f514f8e8 sent the exploit transaction 0x97201900198d0054a2f7a914f5625591feb6a18e7fc6bb4f0c964b967a6c15f6 to its contract 0xae5919160A646f5D80d89F7aaE35A2CA74738440. On January 20 the attacker began depositing ETH into Tornado Cash, for example transaction 0x1fb689f8481a842d9342cbb78d3395988015bd6b6ff5445c97a74ecf78033057 (10 ETH).