What happened
On October 21, 2022, an attacker drained 30,437 vested OHM from OlympusDAO bond markets on Bond Protocol's Ethereum Fixed-Expiry Teller, reported at roughly $300,000 to $315,328. The redeem function did not validate that the caller-supplied bond token was an authorized token issued by the Teller. The attacker deployed counterfeit ERC-20 bond tokens that claimed OHM as their underlying asset, redeemed them against the Teller, and returned all funds to OlympusDAO later that day after contact with the teams.
How it happened
- The attacker deployed a counterfeit ERC-20 token that mimicked a Fixed-Expiry bond token and identified OHM as its underlying asset.
- They passed that attacker-controlled token to the Teller redeem function.
- Because the Teller did not validate the input bond token, it treated the counterfeit token as a valid claim on vested OHM.
- The redemption drained the OHM payout from three OlympusDAO bond markets; the funds were subsequently returned.
Protocol details
Funds Recovery
Recovered
$315K
Net Loss
$0
Evidence
- report Report theblock.co
- report @peckshield incident report twitter.com
- report @Supremacy_CA incident report twitter.com
- report Bond Protocol Incident Report medium.com
- transaction Exploit transaction · Etherscan etherscan.io
- transaction Return transaction · Etherscan etherscan.io
- address Attacker address · Etherscan etherscan.io
- address Attack contract · Etherscan etherscan.io
- analysis DeFiLlama defillama.com
- analysis Hacker drains $300,000 from Olympus DAO on Bond Protocol theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
