What happened
GDAC announced a roughly $13 million wallet theft on April 10, 2023, representing 23% of its holdings. CertiK traced likely initial activity to April 8 on Ethereum and identified a further 10 million WEMIX transfer on the WEMIX chain.
Technical root cause
CertiK considered private-key compromise highly likely, but unconfirmed. Ordinary transfers established movement of funds without revealing how signing access was obtained.
How it happened
- CertiK observed a possible 0.5 ETH test transfer followed by larger transfers from a GDAC-controlled wallet.
- Another wallet sent 220,000 USDT, which was exchanged for ETH and routed to Tornado Cash.
- Ten million WEMIX moved to attacker-controlled addresses and was split among additional addresses.
- GDAC publicly disclosed the compromise on April 10.
Protocol details
Classification
CeFi / Access Control
Protocol Type
Exploit/Access control
Protocol links
Website
@official_gdac
Evidence
- report @MetaSleuth incident report twitter.com
- analysis Support reference support.gdac.com
- analysis Website reference coindesk.com
- analysis DeFiLlama defillama.com
- analysis GDAC Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
