DD coin Hack

DD coin's Marketplace contract was exploited. The attacker increased their allowances and profited for 306,597 $USD.

DD coin is a BEP20 token trading on PancakeSwap. DD coin's Marketplace smart contract had a vulnerability that allowed an attacker to increase their allowances by simulating multiple buy/sell actions from their newly deployed smart contracts and the main malicious smart contract. This gave them enough access to withdraw 306,597 $USD worth of tokens from the Marketplace contract.

Over 80 fake buyer contracts were deployed during this process which resulted in two similar transactions where all these actions occurred. The stolen funds were transferred to another EOA address.

Attacker address:

https://bscscan.com/address/0x0a3fee89…612762

Malicious transactions:

https://bscscan.com/tx/0xd92bf51b…f80809

https://bscscan.com/tx/0x9ba6723c…7ee75a

Funds holder address:

https://bscscan.com/address/0xa100c4b1…5f8847

Malicious contracts addresses:

https://bscscan.com/address/0x105e9b02…f0dd21

https://bscscan.com/address/0x2d9cb2b0…ead8d0