What happened
On February 23, 2026, an exploit of DGLD’s Ethereum-to-Base bridge allowed the creation of unbacked DGLD on Base. The physical gold reserves and legitimate holders’ gold-backed balances were not affected. DGLD estimated the economic impact at about $250,000, primarily to its Base liquidity, and paused the bridge and both smart-contract systems while it contained the incident.
The bridge trusted a non-standard ERC-20 transferFrom success signal without independently verifying the corresponding token movement. Cross-chain minting must verify observed balance changes and enforce bridge accounting invariants rather than treating a token-call return value as sufficient proof of custody.
Case & protocol details
Attack Timeline
The affected bridge accepted a successful return value from the legacy Ethereum DGLD token's transferFrom path as evidence of a deposit. In the vulnerable edge case, that function could report success without moving the expected token balance. An attacker could therefore make the bridge treat a phantom Ethereum deposit as complete, mint unbacked DGLD on Base, and sell those tokens into Base liquidity pools.
DGLD reports that the main activity began around 13:15 UTC and continued for roughly two hours and 25 minutes; bridge and contract pauses prevented attempted transfers back to Ethereum. The protocol subsequently replaced the vulnerable bridge path and migrated Base balances to a new contract.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report DGLD post-incident report: February 2026 exploit dgld.ch
- transaction Transaction basescan.org
- analysis SlowMist DGLD incident record hacked.slowmist.io
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.