DePo Hack

REPORTED LOSS $1.7M
Medium Access Control

What happened

The exploiter:

https://etherscan.io/address/0x6ffe6e18…6be215

The exploiter was a public team member and the deployer of this MasterChef contract:

https://etherscan.io/address/0x1ca1a593…1c8314#code

He was able to invoke emergencyRewardWithdraw() to steal DEPO tokens, the example transactions:

https://etherscan.io/tx/0xd47dfe0b…57a6b7

https://etherscan.io/tx/0x8ac9a06a…4495a5

https://etherscan.io/tx/0x287a7c33…b4e29b

Tokens were sold on Uniswap, the example transactions:

https://etherscan.io/tx/0x05996fc3…ff6a4e

https://etherscan.io/tx/0x82252439…a7940f

https://etherscan.io/tx/0x2d26cf1f…507bbf

Stolen funds were transferred to the external wallet:

https://etherscan.io/tx/0xe7e8cb72…ca5bde

The funds' recipient deposited them into Tornado Cash mixer:

https://bloxy.info/txs/transfers_from/0x10da7563…3307e9?currency_id=1

Case & protocol details

Classification Yield Aggregator
Protocol Type Exploit/Access control
Affected asset / contract DEPO
Official Website www.depo.io/
Protocol Twitter/X @DePo_io

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

AFX $24.1M
B² Network $3.8M
Third-party SquidRouterModule $3.2M
StablR $12.8M

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes