What happened
On May 24, 2022, the Hackerdao token on BNB Smart Chain was exploited for about 200 BNB, roughly $65,000 at the time. The attacker combined a DODO flash loan with the token's extra-fee transfer behavior and AMM pair skim() calls to distort pool reserves and drain value.
How it happened
- The attacker obtained a 2,500 WBNB flash loan from DODO and swapped 1,995 WBNB for Hackerdao.
- It transferred Hackerdao to the Hackerdao-WBNB pool and called
skim()to send those tokens onward to the Hackerdao-USDT pool. - The token charged an additional fee when that USDT pool was the recipient, reducing the Hackerdao-WBNB pool balance below its recorded reserve.
- After updating the WBNB pool reserves, the attacker swapped Hackerdao for an inflated amount of WBNB, repaid the loan, and obtained the reported profit across two exploit transactions.
Protocol details
Classification
Other / Access Control
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
Hackerdao
Implementation language
Solidity
Evidence
- report Web Archive twitter.com
- analysis DeFiLlama defillama.com
- analysis Hackerdao Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
