What happened
On August 12, 2025, Odin.fun's liquidity pools were exploited for a reported 58.2 BTC, worth about $7 million. The attack manipulated token valuations during liquidity operations to extract BTC.
Technical root cause
QuillAudits attributes the exploit to the AMM liquidity model's treatment of manipulated internal prices during withdrawals. Its report does not identify a precise faulty code expression; the absence of an external oracle alone is not enough to establish a code-level root cause.
How it happened
- QuillAudits describes the attacker adding liquidity to the SATOSHI/BTC pool on Odin.fun, which runs on ICP.
- Self-trading inflated the pool's token price.
- Liquidity withdrawal then returned a disproportionate BTC amount; QuillAudits identifies a repeated cycle in ODINPEPE/BTC.
- Odin.fun paused trading and withdrawals and sought help tracing funds.
Protocol details
Classification
Protocol Logic / Exchange (DEX) / Oracle Manipulation
Protocol Type
Exploit/Oracle Issue
Implementation language
Motoko
Protocol links
Website
@Odin_GodOfRunes
Evidence
- report Report uk.finance.yahoo.com
- report @PeckShieldAlert incident report x.com
- report @BobBodily incident report x.com
- analysis Website reference theblock.co
- analysis DeFiLlama defillama.com
- analysis Memecoin Launchpad Odin.fun Suffers $7M Liquidity Exploit coindesk.com
- analysis How Odin.fun Lost 58.2 BTC in a $7M Liquidity Exploit quillaudits.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
