What happened
Late on 5 June 2022 (UTC) an attacker drained 1.65 million EGLD, which Romanian prosecutors valued at about $120.8 million at the time of the transactions, from Elrond's Wrapped EGLD swap contracts by abusing a newly deployed VM function, executeOnDestContextByCaller. The flaw was in the Elrond VM, not in the swap contract's code. The team already knew the function was dangerous and had a patch due to activate on Monday 6 June, and the attack came less than 36 hours before it activated.
The attacker wrapped part of the stolen EGLD into unbacked WEGLD and sold it on Maiar Exchange, crashing the pool price to about $4, and bridged about 4 million USDC and 1 million UTK to Ethereum before the team paused the exchange, the swap contracts and the bridge, froze USDC and UTK transfers, and held another 1.4 million USDC in the bridge. Validators applied an emergency patch within hours, and a second upgrade removed the function entirely. The team recovered most funds, burned the excess WEGLD and topped up the swap contracts, with 200,000 EGLD coming from the Elrond Foundation reserve, and Maiar Exchange reopened on 8 June.
Romanian prosecutors (DIICOT) later said recovery exceeded 95%, leaving about $9.3 million in damage. They charged three former Elrond employees. Romanian media report that two confessed and received suspended sentences, while the third was sent to trial in May 2026.
How it happened
- Elrond had added a VM function,
executeOnDestContextByCaller, that lets contract B call contract C so that C sees the call as coming from B's original caller. - Community developers found that invoking it inside an asynchronous-call callback let a malicious contract act in the name of any same-shard contract it had called, including moving that contract's EGLD. ESDT tokens and staked EGLD on the metachain were out of reach.
- The attacker deployed a malicious contract, a helper contract and two wallets on each of the three regular shards, funded from a Binance hot wallet, and targeted the
egld-esdt-swapcontract in each shard. - Callbacks using the function drained about 400k EGLD on shard 0, 800k on shard 1 and 450k on shard 2.
- The attacker wrapped about 917k of the stolen EGLD into WEGLD through the same swap contracts, which left WEGLD no longer backed 1:1, then sold it in many small swaps for USDC and UTK on Maiar Exchange and bridged part of the proceeds to Ethereum.
- The team paused the DEX, the swap contracts and the bridge, froze USDC and UTK, and shipped an emergency VM patch that validators installed about six hours after the attack began.
Protocol details
Funds Recovery
Recovered
$113.0M
Net Loss
$0
Evidence
- report Report bitdegree.org
- report Report elrond.com
- report Report cryptotodayinfo.com
- report Elrond Incident and Recovery Report multiversx.com
- analysis DeFiLlama defillama.com
- analysis Maiar DEX responsible disclosure policy xexchange.com
- analysis Procurorii DIICOT au făcut percheziții privind furtul de criptomonede Elrond din 2022. MultiversX salută progresele autorităților startupcafe.ro
- analysis Cum și cine a executat o fraudă de proporții pe platforma crypto ELROND de la Sibiu nocash.ro
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
