MAD Hack

The $MAD token was stolen by a hacker who noticed a vulnerability in the contract that held most of the assets. The hacker withdrew the profit through Tornado.cash.

Token $MAD had been stolen from the token storage due to the lack of specific verification, as a result, anyone could pick up tokens, knowing how to interact with the function. The contract is unverified, so the function looks like "0x9763a894". The hacker stole the tokens, and called selfdestruct in this transaction: Tx 0xbaf4…ab59

Then, using another contract, he took the tokens from all the addresses where the tokens from the previous transaction were sent and swapped them to $BSC-USD via PancakeSwap: Tx 0xbaf4…ab59.

Which were subsequently sent to the main address from which the money was withdrawn via Tornado.cash:

Tx 0x39dd…4def

Token creator address: Address 0x963f…a2ec

Token contract: Address 0x525c…2094

Vulnerable storage contract: Address 0x19b9…BaD8

Attacker addresses: Address 0x957e…ae93

Attacker contract addresses:

1. Address 0xe601…6819
2. Address 0x2002…7f28