Incident Overview
On June 1, 2026, the DeFi protocol TesseraDAO suffered a critical infrastructure attack on the BNB Chain. An attacker gained unauthorized control over the core contract's execution logic, allowing them to mint 99 million TSR tokens out of thin air. The attacker immediately dumped the tokens into decentralized liquidity pools for approximately $2.4 million, causing the price of $TSR to plummet by 99%.
The exploit was made possible through an arbitrary execution path vulnerability or direct administrative credential leak affecting the core contract. On-chain analysis indicated structural contract issues, including flaws similar to unsafe low-level delegatecall vulnerabilities where execution targets could be altered or forced.
By gaining administrative or upgraded execution rights, the attacker invoked a privileged minting command to generate 99 million $TSR tokens directly to their wallet. To extract the maximum possible value before the market reacted, the attacker coordinated a massive swap execution via PancakeSwap, liquidating the unbacked tokens into roughly 2.5 million USDT. This strategic conversion occurred entirely on the BNB Chain to capture available pool depth before it collapsed. The attacker then bridged the stablecoin proceeds over to the Ethereum mainnet, converted the capital into 1,285.5 ETH, and completely laundered the funds using the Tornado Cash privacy protocol.
Attacker Address: 0x2201037A…6f2Dd8
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Tessera DAO, these are the critical security checks that could have prevented this incident (June 2026).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Proof-of-Concept Exploits
On-Chain Evidence & References
- Reference https://t.me/defimon_alerts/3038
Sources & References
Learn to Prevent the Next Tessera DAO
The Tessera DAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.