What happened
The address involved in the scam:
The address involved in the scam deployed the unverified contract which contained withdraw() function that allows only the owner to withdraw the entire total BNB (eth.balance(this.address) wei) to the owner’s address.
The contract deployer invoked withdraw() to transfer 6,445.42 BNB onto own address at:
Stolen funds were distributed to a bunch of external addresses and deposited into the Tornado Cash mixer.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
