What happened
On December 8, 2025, DMi’s DMi/WBNB PancakeSwap pool on BNB Smart Chain was drained through a token-transfer logic flaw. The DMi implementation redirected transfer() calls addressed to the liquidity pair away from the pair, while transferFrom() could still credit it normally. That inconsistency desynchronized the AMM’s actual DMi balance from its recorded reserves.
An attacker used the resulting pricing distortion in one transaction to extract about $124,000 in WBNB value.
DMi gave transfer() and transferFrom() incompatible semantics for transfers to its PancakeSwap pair. The transfer() branch redirected the full amount away from the intended recipient, breaking the AMM invariant that its token balance tracks the reserves used in pricing. The exploitable condition was the asymmetric token accounting, not the flash loan itself.
Case & protocol details
Attack Timeline
The attacker used flash liquidity to execute a sequence of DMi transfers and swaps against the DMi/WBNB pair in one atomic transaction. A transfer() directed to the pair sent the DMi amount to outfee_add instead of the pair, while transferFrom() delivered DMi normally. Alternating those paths let the attacker create a mismatch between the pair’s actual token balance and the reserves used for swap pricing.
Once the reserves were distorted, a final swap overpaid WBNB; the flash liquidity was repaid and the reported remainder was about 138.68 WBNB.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report blog.solidityscan.com
- transaction Transaction bscscan.com
- analysis DMi Token Hack Analysis blog.solidityscan.com
- analysis Olympix exploit roundup — DMi Token olympix.security
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.