What happened
On June 24, 2026, DLMC on BNB Smart Chain lost about $222,560 USDT in a flash-loan-assisted treasury drain.
Technical root cause
DLMC calculated redemptions from USDT reserves divided by externally circulating supply while excluding newly minted contract-held tokens, so flash-funded deposits could inflate its internal price and make reward redemptions overpay.
How it happened
The attacker flash-swapped about 1.42 million USDT, used helper referral accounts to make large buys, inflated DLMC's internal livePrice, then sold referral/DAO reward tokens back to the contract before repaying the loan.
Protocol details
Classification
Oracle Manipulation
Protocol Type
Token
Implementation language
Solidity
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
