Tessera DAO Hack

On June 1, 2026, the DeFi protocol TesseraDAO suffered a critical infrastructure attack on the BNB Chain. An attacker gained unauthorized control over the core contract's execution logic, allowing them to mint 99 million TSR tokens out of thin air. The attacker immediately dumped the tokens into decentralized liquidity pools for approximately $2.4 million, causing the price of $TSR to plummet by 99%.

The exploit was made possible through an arbitrary execution path vulnerability or direct administrative credential leak affecting the core contract. On-chain analysis indicated structural contract issues, including flaws similar to unsafe low-level delegatecall vulnerabilities where execution targets could be altered or forced.

By gaining administrative or upgraded execution rights, the attacker invoked a privileged minting command to generate 99 million $TSR tokens directly to their wallet. To extract the maximum possible value before the market reacted, the attacker coordinated a massive swap execution via PancakeSwap, liquidating the unbacked tokens into roughly 2.5 million USDT. This strategic conversion occurred entirely on the BNB Chain to capture available pool depth before it collapsed. The attacker then bridged the stablecoin proceeds over to the Ethereum mainnet, converted the capital into 1,285.5 ETH, and completely laundered the funds using the Tornado Cash privacy protocol.

Attacker Address: 0x2201037A…6f2Dd8