Feminist Metaverse Hack

Reported loss $540K
BNB Chain
Other

What happened

On May 18, 2022, the Feminist Metaverse FM token on BNB Smart Chain was exploited for about 1,838 BNB (roughly $533,000-$540,000), and FM's price fell about 99.7%. A flaw in the token's own liquidity-adding logic left FM tokens in its trading pair without updating the pair's reserves, so anyone could skim them. The attacker moved the stolen BNB to Tornado Cash within hours.

The team said it was working with CertiK and other security firms, and planned to redeploy the contract within 10 working days and swap old FM for new FM one-for-one, with a re-audit before its June dApp launch.

How it happened

  1. The FM token contract held a balance of its own tokens that it moved into its liquidity pair when adding liquidity. It used a plain ERC-20 transfer to do this, without updating the pair's reserves.
  2. The attacker made a series of transfers that triggered this logic, pushing about 75.15 million contract-held FM into the pair.
  3. Because the pair's token balance now exceeded its recorded reserves, the attacker called the pair's skim function to send the excess FM to their own address.
  4. The attacker sold the FM for about 1,838 BNB and sent it to Tornado Cash.

Protocol details

Classification Gaming / Metaverse / Access Control
Protocol Type Exploit/Other
Affected asset / contract FmToken
Implementation language Solidity
Protocol links Website @FM_Token

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
BNB Chain ShadowFi $303K lost Fantom Reaper Farm $1.7M lost BNB Chain Umbrella Network $700K lost BNB Chain Crosswise $879K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes