Elephant Money Hack

Reported loss $163K
BNB Chain
Flash Loan Attack

What happened

On December 6, 2023, an attacker drained funds from an Elephant Money treasury contract on BNB Smart Chain. The target was an unverified contract deployed by Elephant Money that had permission to withdraw treasury funds and exposed a public sweep() function. Calling sweep() made the contract pull funds and swap them on PancakeSwap with no slippage protection, so the attacker could make it trade at a price they had just manipulated with flash-loaned BUSD.

Loss estimates differ: Decurity reported about $114,000, while the DeFiHackLabs reproduction puts it at about $165,000. This is a separate event from the April 2022 Elephant Money Reserve exploit.

How it happened

  1. The attacker flash-borrowed the BUSD balances of four PancakeSwap V3 pools (USDC/BUSD, BUSDT/BUSD, WBNB/BUSD and BTCB/BUSD), nesting each loan inside the previous callback.
  2. They swapped the borrowed BUSD for WBNB on PancakeSwap, pushing the WBNB price up in the BUSD/WBNB pool.
  3. They called the unprotected sweep() on 0x8cf0...5740, which withdrew treasury funds and bought WBNB at the inflated price with no minimum-output check, pushing WBNB higher still.
  4. The attacker sold their WBNB back to BUSD at the elevated price, repaid the flash loans plus fees and kept the difference.

Protocol details

Classification Token / Other / Oracle Manipulation
Protocol Type Yield
Affected asset / contract ELEPHANT
Implementation language Solidity
Protocol links Website @ElephantStatus

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
BNB Chain CUT token $1.4M lost BNB Chain ZongZi $230K lost BNB Chain Carson $150K lost Polygon QuickSwap $220K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes