What happened
On May 28, 2026, the ONTR token's Ethereum liquidity pool was drained of about 49.48 WETH, then estimated at roughly $98,315.
Technical root cause
The custom onlyOwner check accepted either the stored owner or the caller when the stored owner was address(0), so renouncing ownership turned a privileged gate into a public one.
How it happened
The contract creator had renounced ownership, but its custom ownership check treated a zero owner address as authorized. The attacker could therefore reclaim privileged access, alter token balances, and swap the resulting tokens against the ONTR/WETH pool.
Protocol details
Classification
Access Control
Protocol Type
Token
Implementation language
Solidity
Exploit Transaction
0x98f80eff0ce609606b…0c54903621
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
