BasketDAO Hack

TOTAL LOST $107K
Low Other

Summarize with AI

ChatGPT Perplexity Claude Grok
Affected Chain 2024 Incident surface
Recovered - No recovery reported
All-Time Rank #1508 By amount stolen
Auditors 1 Prior security audit

Incident Overview

Quick Summary

BasketDAO exploited due to smart contract vulnerability, resulting in a loss of approximately $107,000 worth of assets (42.55 ETH).

Details of the Exploit

BasketDAO, a decentralized platform, experienced an exploit on January 17, 2024, on the Ethereum Mainnet. The exploit was caused by a smart contract vulnerability, specifically an arbitrary low-level call in the approval process. This flaw led to a user losing over $107,070 worth of assets, equivalent to 42.55 ETH.

The attacker was funded by FixedFloat and subsequently deposited the stolen funds into TornadoCash.

Block Data Reference

Attacker Address:

https://etherscan.io/address/0x63136677…14f8e8

Malicious Transaction:

https://etherscan.io/tx/0x97201900…6c15f6

Malicious Contract Address:

https://etherscan.io/address/0xae591916…738440

TornadoCash Deposit Transactions:

https://etherscan.io/tx/0x1fb689f8…033057

https://etherscan.io/tx/0xa95ee355…1f4a7d

Incident Report

Protocol / Project BasketDAO
Date of Incident
Attack Technique Other
Classification Other
Primary Source View Post-Mortem

Protocol Information

Protocol Type Indexes
Affected Token BMI
Official Website www.basketdao.org/
Protocol Twitter/X @BasketDAOOrg
Team Anonymous
Source Code Verified On-Chain

Market Context at Time of Hack

Token Categories
Ethereum Ecosystem
Protocol Links

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of other and Solidity and EVM internals
Capital Required Seed capital to cover gas and initial position setup
On-Chain Access Ability to interact with smart contracts and deploy a custom exploit contract
Protocol Analysis Identification of the exploitable vulnerability in BasketDAO's contract logic - root cause: other
Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block
Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough Other audit checklist and test coverage
Audited by Audit Report 1 — still lost $107K. Prior audits don't guarantee safety, especially after post-audit code changes.

If you're auditing a protocol with similar architecture to BasketDAO, these are the critical security checks that could have prevented this incident (January 2024).

  • Verify all logic paths related to Other are guarded by proper access controls and input validation
  • Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Security Audit History

Sources & References

Browse all hacks

These hacks used the same attack technique. Understanding the pattern helps prevent future exploits.

DeFiTuna $570K
Other
Cascade $1.3M
Other
Lumi Finance $264K
Other
Hinkal $820K
Other
AIDCToken $121K
Other
Polymarket $3.0M
Other

Learn to Prevent the Next BasketDAO

The BasketDAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library
Recreate exploit patterns safely Free Trial