Ragnarok Online Invasion Hack
What happened
On September 8, 2022, the BNB Smart Chain ROI token for Ragnarok Online Invasion was exploited through an ownership-transfer access-control failure. An unauthorized caller took control of the token contract, exchanged ROI through the liquidity path, and withdrew approximately 162.5 BNB. Contemporary security analysis valued the withdrawn assets at about $47,384 and reported a near-total collapse in the token price.
The ownership-transfer function lacked an effective onlyOwner or equivalent administrator check, allowing an arbitrary caller to obtain privileged control. Any function that changes owner, governor, minting, pausing, or withdrawal authority must enforce a single verified authority, emit and monitor ownership changes, and be tested from an unprivileged caller.
Case & protocol details
How it happened
The ROI token contract exposed its ownership-transfer path without an effective ownership or administrator restriction. The attacker called the vulnerable path to transfer token-contract control to an attacker-controlled address. With privileged control in hand, the attacker carried out a series of swaps from ROI to BUSD and then BNB, before calling the withdrawal function.
The final withdrawal removed roughly 162.5 BNB from the affected liquidity path. This was not an access-control bypass of a correctly protected administrator: the contract’s ownership-transfer function itself failed to enforce who could invoke it.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report archive.is
- transaction BscScan exploit transaction bscscan.com
- analysis ImmuneBytes detailed ROI hack analysis immunebytes.com
- analysis BscScan compromised ROI token contract bscscan.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
