New Free DAO Hack

The New Free DAO project was subjected to a flash loan attack, suffering losses of $1.25M.

New Free DAO is a DAO project that give participants the opportunity to coordinate activities and manage resources in accordance with a pre-agreed and formalized set of rules.

The attackers took 250 $WBNB via flash loan and swapped the loaned funds for $NFD tokens via the $WBNB -> $USDT -> $NFD path.

The attackers contract then created multiple contracts to claim airdrop rewards from the targeted victim contracts.

The attacker returned the flash loan and swapped all the $NFD for $WBNB. Then the malicious actor swapped 2k $BNB for $USDT.

Step by step the transaction occurred as follows:

- The scammer took a flash loan for $250 $BNB

- The $BNB tokens were then exchanged for the $NFD tokens

- The scammer contract had the ability to create malicious contracts that also created contracts and transferred them all tokens received from airdrop.

- In the end, the last contract exchanges the entire balance of $NFD tokens for $BNB, transfers them to the main contract, restores the flash loan, and then the main contract transfers the funds to the scammer.

All the stolen funds have been transferred through tornado.cash.

Attacker address: https://bscscan.com/address/0x22c9736d…9d6fd2

Attacker contract address: https://bscscan.com/address/0xa35ef9fa…948863

Flash Loan attack transactions:

1. Tx
2. Tx

Swap NFD to BNB transactions:

1. Tx
2. Tx

Pair address: https://bscscan.com/address/0x26c06238…bdaeaf