Journey of Awakening Hack

Reported loss $127K
Other

What happened

On October 12, 2022, an attacker took about $127,800 from Journey of Awakening's ATK token on BNB Smart Chain. According to CertiK, ATK's staking contract distributed rewards based on the current value of ATK, and the exploit reproduction shows that value came from the token's live PancakeSwap price. The attacker used a flash swap to crash that price for one transaction, claimed rewards at the crashed price, and received about 50.6 million ATK.

After selling the ATK, they sent most of the proceeds through Tornado Cash. ATK's price fell sharply; CertiK's alert reported a drop of more than 99%, while its later analysis said about 69%.

How it happened

  1. About 24 hours before the attack, the attacker deposited 970.4 ATK into the staking contract so they would qualify for rewards.
  2. From their exploit contract, the attacker flash-swapped almost all of the BSC-USD out of the PancakeSwap ATK/BSC-USD pair, about $130,000. With little USDT left in the pool, ATK's spot price collapsed.
  3. Inside the flash-swap callback, the attacker called the reward claim function (claimToken1()). It priced the payout with ATK's getPrice(), which read the manipulated pool, so it paid out about 50.6 million ATK.
  4. The attacker repaid the flash swap, sold the ATK for 127,677 USDT, and converted it to BNB.
  5. The attacker moved about 473.7 BNB to Tornado Cash.

Protocol details

Classification Token
Protocol Type Exploit/Other
Affected asset / contract ATK

Evidence

Same attack technique

Browse all hacks →
Victor the Fortune $58K lost GeoDB Loss not disclosed Rabby Wallet $194K lost Boy X Highspeed $2.6M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes