Dream Health Chain Hack

Reported loss $72K
BNB Chain
Reward Logic Flaw

What happened

On 5 September 2026 an attacker took about $71,800 (71,851 USDT) from Dream Health Chain's (DHC) award staking contract on BNB Chain by claiming the same reward over and over. According to SlowMist, the contract's award logic had no guard against reclaiming. After a reward was claimed, participating again with a tiny or zero-value DHC amount reset the award to claimable, and the contract paid the same fixed reward again from the shared pool.

The attacker looped this reset-and-claim cycle until the contract's DHC was gone, then sold about 542,070 DHC into the DHC-USDT pool. DeFiHackLabs found the attack ran as four transactions in a single block.

How it happened

  1. Using a USDT flash loan, the attacker bought some DHC on PancakeSwap, registered an inviter (the award system rejects participants without one) and created an award with a fixed reward.
  2. It joined the award with a full pledge and claimed it once, moving the award to status 2 (claimed).
  3. It called the participate function again with 0-1 wei of DHC. The contract did not check whether the award was already claimed and reset it to status 1 (claimable).
  4. It claimed again. claimAward paid the same fixed reward from the proxy's shared DHC balance, because no reserve was locked for each award.
  5. It repeated steps 3-4 until the proxy's DHC was drained, sold the DHC for USDT, repaid the flash loan and kept about 71,851 USDT (tx 0xb4c89845d95fd721e6931dd223e24e8b78a9de8c3b4428251a36d9213e44c496).

Protocol details

Classification Protocol Logic
Protocol Type DeFi Protocol
Implementation language Solidity

Evidence

Same attack technique

Browse all hacks →
Sui Scallop Lend $142K lost BNB Chain Grizzifi $61K lost Ethereum Sorra Finance $41K lost Ethereum OTSea $26K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes