Elephant Money TRUNK Reserve Hack
What happened
On April 12, 2022, an attacker manipulated ELEPHANT's price during TRUNK minting and redemption on BNB Chain. Reported dollar figures differ: the incident feed records $22.2 million, while Elephant Money's reserve update identifies 27,416 BNB, then valued at $11.2 million. These are not interchangeable measures of attacker profit.
The TRUNK mint and redemption path relied on the instantaneous ELEPHANT/WBNB pool price. Its internal purchase flow created a feedback loop that let temporary price manipulation affect minting and redemption values.
How it happened
- Flash loans supplied about 131,000 WBNB and 91 million BUSD. Buying ELEPHANT distorted the ELEPHANT/WBNB pool price.
- Minting TRUNK with BUSD triggered the protocol's own ELEPHANT purchases, amplifying the price movement.
- The attacker sold ELEPHANT into the inflated market, then redeemed TRUNK for BUSD and ELEPHANT and swapped the resulting assets.
- The flash loans were repaid, leaving value extracted from the reserves.
The team paused minting, redemption, and Stampede while investigating. The failure was in the mint/redemption economics, not evidence of an administrator-key compromise.
Protocol details
Security review history
- CertiK View report
- Solidity Finance View report
Evidence
- report @BlockSecTeam incident report twitter.com
- report Reserve Exploit medium.com
- report @CertiKAlert incident report twitter.com
- report @peckshield incident report twitter.com
- report Elephant Money Reserve Exploit Analysis rekt.news
- analysis DeFiLlama defillama.com
- analysis Elephant Money Hack: April 12, 2022 Detailed Analysis immunebytes.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
