What happened
On May 11, 2025, Mobius Token's MBU contract on BNB Smart Chain was exploited for approximately $2.16 million. CertiK reported that an extra 10 to the 18th-power multiplier in an unverified minting contract inflated the token calculation, allowing the attacker to mint about 9.73 quadrillion MBU with 0.001 BNB and swap the tokens for USDT.
How it happened
- The attacker called the vulnerable deposit function with 0.001 BNB.
- The minting calculation combined price values that already used 18 decimals with an additional 10 to the 18th-power multiplier.
- This inflated the MBU output by a factor of 10 to the 18th power.
- The attacker minted about 9.73 quadrillion MBU and swapped it for about 2.157 million USDT.
- CertiK reported that 2,100 BNB was then sent through Tornado Cash in batches.
Protocol details
Classification
Protocol Logic / Token / Token & Share Accounting
Protocol Type
Exit Scam/Other
Implementation language
Solidity
Evidence
- report Report certik.com
- analysis DeFiLlama defillama.com
- analysis Mobius Token Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
