What happened
On May 4, 2022, MM Finance's Cronos frontend was compromised and users' transaction outputs were redirected to an attacker-controlled router. The attack affected swaps and liquidity operations for about three hours and caused losses reported at more than $2 million.
How it happened
- The attacker altered MM Finance's hosted frontend through a reported DNS-related compromise and inserted a malicious router address.
- Users who signed swaps, liquidity additions or removals interacted with the malicious route.
- The router redirected transaction outputs to the attacker.
- The frontend was taken down after roughly three hours; the opened report describes more than 600 redirected transactions.
Protocol details
Classification
Exchange (DEX) / Infrastructure / Frontend & Infrastructure
Protocol Type
DEX
Affected asset / contract
MMF
Protocol links
Website
@MMFcrypto
Security review history
- CertiK View report
Evidence
- report @MMFcrypto incident report twitter.com
- report Post-mortem medium.com
- report MM Finance - REKT rekt.news
- analysis DeFiLlama defillama.com
- analysis How Hackers Use DNS Hijacking Attacks to Steal Funds and Clone Websites certik.com
- analysis More than $2 million stolen from DeFi platform MM.Finance therecord.media
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
