LW Hack

LW token's URoter contract was exploited leading to a loss of 49,300 $USD.

LW is a BEP20 token trading on PancakeSwap. The project's URoter contract was exploited which resulted in a loss of 49,300 $USD. The attacker took out a flash loan worth 1,000,000 $USD and used it to exploit logic flaws in the URoter contract by deploying their own malicious smart contract that drained funds.

Once they had successfully stolen the funds, they repaid their flash loan and made off with their profits. In total, 150 $BNB was transferred through TornadoCash for anonymity purposes.

Attacker address:

https://bscscan.com/address/0x4404de29…7973e5

Malicious transaction:

https://bscscan.com/tx/0xb846f3ae…5e4e4a

Funds transfer example transaction:

https://bscscan.com/tx/0x46171312…2d3a97

Malicious Contract:

https://bscscan.com/address/a4fbc2c95ac4240277313bf3f810c54309dfcd6c