Tapioca DAO Hack
What happened
Tapioca DAO lost approximately $4.7 million on Arbitrum after a core contributor's private key was compromised through a social-engineering malware attack. The key controlled privileged TAP and USDO administration as a single-signer hot wallet, enabling unauthorized minting and token extraction.
A privileged administrative key was stored and used as a single-signer hot wallet despite an intended multisig design. Its compromise gave the attacker direct authority over sensitive minting and rescue functions. The incident was a key-compromise and operational-control failure, not a discovered smart-contract logic flaw.
How it happened
Using the compromised administrative key, the attacker added an unauthorized USDO minter and minted 315.5 trillion USDO, then exchanged it to drain about $3.1 million USDC from the USDO/USDC pool. The attacker also used a vesting-contract rescue function to take TAP tokens and sold them for ETH.
Tapioca removed liquidity from affected pools, reported roughly $700,000 protected, and later reported recovery of about $2.65 million in ETH collateral through a counter-exploit. The remaining gross loss was not fully recovered.
Protocol details
Funds Recovery
Recovered
$2.6M
Net Loss
$2,049,200
Evidence
- report @tapioca_dao incident report x.com
- report Tapioca DAO Incident Post-Mortem paragraph.com
- transaction TAP-to-ETH Exploit Swap arbiscan.io
- analysis DeFiLlama defillama.com
- analysis Tapioca DAO Stops Additional Losses After Exploit theblock.co
- analysis Tapioca Bounty Offer for Phishing Attacker ct.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
