What happened
On April 28, 2026, JUDAO on BNB Smart Chain was exploited for an estimated $228,000 through flash-loan-assisted manipulation of its liquidity-pair reserves.
Technical root cause
JUDAO's sell logic allowed its transfer hook to burn tokens from the liquidity pool and resynchronize pair reserves during a swap, so the AMM calculated output from manipulated reserves.
How it happened
- The attacker used a roughly $2.3 million USDT flash loan to buy JUDAO, then sold it into the PancakeSwap pair.
- The token's sell path burned tokens from the pool and called sync before swap output was calculated, distorting reserves and allowing excess USDT extraction.
Protocol details
Classification
Token & Share Accounting
Protocol Type
Token
Implementation language
Solidity
Evidence
- analysis DeFiLlama defillama.com
- analysis JUDAO Hack Analysis blog.verichains.io
- analysis Judao sell logic flaw analysis olympix.security
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
