What happened
On May 10, 2022, an attacker drained 930 million OWN tokens from OWNLY's Mustachio Marauder NFT staking contract. The attacker repeatedly claimed through the faulty unstake flow, then swapped the drained OWN for roughly 115 BNB, estimated at about $37,000.
How it happened
- The attacker used a purpose-built contract to stake OWN in the affected NFT staking program.
- The contract called the unstake path repeatedly, receiving more OWN each time because the staking state was not properly consumed.
- This continued until the staking contract's OWN balance was drained.
- The attacker swapped the OWN through a BNB-chain pair and transferred the resulting BNB away.
Protocol details
Classification
NFT / Protocol Logic
Protocol Type
Exploit/Reentrancy
Affected asset / contract
OWN
Implementation language
Solidity
Evidence
- report Report archive.is
- code A Historical Collection of Reentrancy Attacks github.com
- analysis DeFiLlama defillama.com
- analysis OWNLY Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
