DGLD Hack
What happened
On February 23, 2026, an exploit of DGLD’s Ethereum-to-Base bridge allowed the creation of unbacked DGLD on Base. The physical gold reserves and legitimate holders’ gold-backed balances were not affected. DGLD estimated the economic impact at about $250,000, primarily to its Base liquidity, and paused the bridge and both smart-contract systems while it contained the incident.
The bridge trusted a non-standard ERC-20 transferFrom success signal without independently verifying the corresponding token movement. Cross-chain minting must verify observed balance changes and enforce bridge accounting invariants rather than treating a token-call return value as sufficient proof of custody.
How it happened
- The affected bridge accepted a successful return value from the legacy Ethereum DGLD token's transferFrom path as evidence of a deposit.
- In the vulnerable edge case, that function could report success without moving the expected token balance.
- An attacker could therefore make the bridge treat a phantom Ethereum deposit as complete, mint unbacked DGLD on Base, and sell those tokens into Base liquidity pools.
- DGLD reports that the main activity began around 13:15 UTC and continued for roughly two hours and 25 minutes; bridge and contract pauses prevented attempted transfers back to Ethereum.
- The protocol subsequently replaced the vulnerable bridge path and migrated Base balances to a new contract.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
