DKP Token Hack

Reported loss $79K
BNB Chain
Other

What happened

DKP, a BEP-20 token traded on PancakeSwap, was drained for roughly $80,000 on March 8, 2023 (about 79,233 USDT by the reported profit figure). A separate DKP exchange contract let users buy DKP with USDT, but priced DKP from the live balance ratio of the USDT-DKP PancakeSwap pair. The attacker flash-borrowed almost all of the pair's USDT, which made DKP look nearly worthless to the exchange, bought 17,029 DKP for 100 USDT, and sold it back into the pool for USDT.

The exchange contract (0x89257A52Ad585Aacb1137fCc8abbD03a963B9683) was closed source, so the analysis rests on the observed transactions.

**Block data**

  • Attacker: 0xf38b677fa6e9e51338d0c32fd21afe43406e06df
  • Attack contract: 0xf34ad6cea329f62f4516ffe00317ab09d934fba3
  • Exploit transaction: 0x0c850f54c1b497c077109b3d2ef13c042bb70f7f697201bcf2a4d0cb95e74271
  • Sell transaction: 0x2d31e45dce58572a99c51357164dc5283ff0c02d609250df1e6f4248bd62ee01
  • DKP token: 0xd06fa1BA7c80F8e113c2dc669A23A9524775cF19
  • USDT-DKP pair: 0xBE654FA75bAD4Fd82D3611391fDa6628bB000CC7

How it happened

  1. The attacker flash-swapped about 259,390 USDT (BSC-USD) out of the USDT-DKP PancakeSwap pair, draining almost all of its USDT side.
  2. Inside the pancakeCall callback, a helper contract called exchange() on the DKP exchange contract with 100 USDT. Because the exchange priced DKP from the pair's current USDT/DKP balance ratio, the near-empty USDT side made DKP look extremely cheap, and the call returned 17,029 DKP.
  3. The borrowed USDT plus the swap fee was returned to the pair in the same callback, restoring the pool's USDT balance and DKP's price.
  4. In a second transaction the attacker sold the 17,029 DKP to the pair through swapExactTokensForTokensSupportingFeeOnTransferTokens, taking out roughly 79,233 USDT.

Protocol details

Classification Token / Oracle Manipulation
Protocol Type Exploit/Other
Affected asset / contract DKP
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
BNB Chain Black Hole $1.3M lost BNB Chain LW $49K lost BNB Chain BlackGold $18K lost Ethereum Alpha Finance Lab $171K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes