MAD Hack

The $MAD token was stolen by a hacker who noticed a vulnerability in the contract that held most of the assets. The hacker withdrew the profit through Tornado.cash.

Token $MAD had been stolen from the token storage due to the lack of specific verification, as a result, anyone could pick up tokens, knowing how to interact with the function. The contract is unverified, so the function looks like "0x9763a894". The hacker stole the tokens, and called selfdestruct in this transaction: https://bscscan.com/tx/0xbaf42be5…08ab59

Then, using another contract, he took the tokens from all the addresses where the tokens from the previous transaction were sent and swapped them to $BSC-USD via PancakeSwap: https://bscscan.com/tx/0xbaf42be5…08ab59.

Which were subsequently sent to the main address from which the money was withdrawn via Tornado.cash:

https://bscscan.com/tx/0x39ddbe91…114def

Token creator address: https://bscscan.com/address/0x963fc5af…34a2ec

Token contract: https://bscscan.com/address/0x525c8e9c…b02094

Vulnerable storage contract: https://bscscan.com/address/0x19b9c698…95BaD8

Attacker addresses: https://bscscan.com/address/0x957e949a…1eae93

Attacker contract addresses:

1. Address
2. Address