What happened
Saga DAO, a community fan club for Solana's Saga phone, lost 750 SOL (over $60,000, about 70% of its treasury) on January 24, 2024. The DAO had moved its token-sale funds into a new Squads multisig meant to be controlled by 12 committee members. SagaDAO later said the approval threshold had been set to 1 of 12 instead of the expected 60%, so a single signer could move everything. The funds sat under co-founder zkRedDevil's control, and within minutes they were sent to another address.
zkRedDevil said their PC had been hacked remotely and that they had also lost about $35,000 of their own money. Another DAO member publicly accused them of taking the funds. Who moved the money was never publicly established.
About a week later SagaDAO announced it had recovered all the stolen funds: 65,761.03 USDC was sent from the attacker's address back to an Align multisig protected by Phase Labs.
How it happened
- Saga DAO moved its treasury from its old multisig to a new Squads multisig with 12 committee members as signers.
- The threshold was set to 1 of 12 instead of about 60%, so the multisig protection never took effect.
- On January 24, 2024, about 750 SOL was moved out of that wallet, which co-founder zkRedDevil controlled, to another address within minutes. One signature was enough.
- About a week later, 65,761.03 USDC was returned from the attacker's address to a new Align multisig protected by Phase Labs.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
