Incident Overview
Elephant Money suffers flash loan attack leading to a loss of $163,415 USD.
On December 6th, 2023, Elephant Money, a project running on Binance Smart Chain with its BEP20 token ELEPHANT, fell victim to a flash loan attack. The attacker exploited the project by calling sweep() to force the contract to withdraw funds and execute a swap without slippage protection. As a result, the attacker managed to steal 163,638 BUSD in two transactions.
The stolen funds remain in the attacker's wallet as BUSD.
Attacker address:
https://bscscan.com/address/0xbbcc1399…F1D66D
Malicious Transactions:
https://bscscan.com/tx/0xd423ae0e…523439
https://bscscan.com/tx/0x7ccb189c…2d5218
Malicious contract:
https://bscscan.com/address/0x69BD13F7…8D6Bcf
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Elephant Money, these are the critical security checks that could have prevented this incident (December 2023).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
-
02
Web Archive https://archive.ph/2gKPi
Learn to Prevent the Next Elephant Money
The Elephant Money hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.