What happened
Telcoin App, a Polygon-based mobile wallet, was exploited due to a smart contract vulnerability, resulting in the loss of 1,272,782 USD worth of MATIC and ETH.
Telcoin App is a mobile wallet operating on the Polygon chain. On December 23, 2023, the app's proxy smart contract was exploited by an attacker who took advantage of an uninitialized smart contract. This allowed the attacker to gain a large number of TEL tokens.
The stolen funds were then swapped for MATIC and a portion was also swapped for ETH, which was bridged to the Ethereum Mainnet. The total loss from this exploit amounts to approximately 1,272,782 USD worth of MATIC and ETH.
Attacker Address:
https://polygonscan.com/address/0xdb4b84f0…f3a5b7
Funds Holder as of Jan 03, 2024:
https://polygonscan.com/address/0x35d2775e…85ff98
Malicious Transactions:
https://polygonscan.com/tx/0x35f50851…1d902d
https://polygonscan.com/tx/0x0b2c7e34…b1c0c3
Malicious Contract Address:
https://polygonscan.com/address/0x10E5C8d3…d8BdE0
Case & protocol details
Security review history
- CertiK Report
Funds Recovery
Recovered
$1.3M
Net Loss
$0
Post-Incident Timeline
-
2024-01-12
Telcoin restored stolen user funds fully as the company's CEO told.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- analysis Web Archive archive.is
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.