Tessera DAO Hack

Reported loss $2.4M

Jun 01, 2026 BNB Chain

Access Control

What happened

On June 1, 2026, the TesseraDAO protocol on BNB Chain was drained by whoever controlled its admin key. That key still held unrevoked authority over role assignment, ownership, minting and withdrawals. The holder minted 99 million TSR, converted them into about 2.48 million BSC-USD (USDT), and withdrew the stablecoins. TSR fell about 99%. The proceeds were bridged to Ethereum, and 1,285.5 ETH went through Tornado Cash. Public sources do not establish whether the key was stolen or used by an insider. TesseraDAO had issued no statement by June 2, and Rekt reported that its first post after the drain did not mention the exploit.

Attacker wallet: 0x2201037A1755eC48eC5f00Fea21A10A9E56f2Dd8 Mint transaction (BSC): 0x25093e573c116562c8839dc67a15ac21761271006a8dfe50b18fa475564bfcd1

How it happened

The admin key 0x61a23e0eba09096ffeb954aa8a93c3079e87cf17 called reassignRole() on the TesseraDAO contract, moving the trader and withdrawer roles to the attacker wallet 0x2201...2Dd8 (tx 0xa748067f...d79d721).
A transferOwnership() call then gave the attacker ownership of the contract (tx 0xf799e7b0...af7d2453).
The attacker minted 99 million TSR from the zero address (tx 0x25093e57...5564bfcd1).
The minted TSR was converted into 2,475,659 BSC-USD through the protocol's own trade() function (tx 0x756d33e7...d88c9bb).
Two withdrawal transactions moved the stablecoins out. The funds were bridged to Ethereum, and 1,285.5 ETH was deposited into Tornado Cash.

Protocol details

Classification Other / Access Control / Token & Share Accounting

Protocol Type Exploit/Access control

Implementation language Solidity

Protocol links @TesseraDao

Market Context at Time of Hack

Token Price at Hack $0.00015182

Market Cap at Hack $152K

Reported loss / token market cap 100.00%

Token Categories

Artificial Intelligence (AI) Base Ecosystem AI Agents

Protocol Links

Telegram Website

Evidence

Proof of concept

1 available

Code TesseraSwap Callback Repayment Price Spread

Sources

report @PeckShieldAlert incident report x.com
report @SpecterAnalyst incident report x.com
report TesseraDao - Rekt rekt.news
analysis Website reference t.me
analysis DeFiLlama defillama.com
analysis PeckShield Says TesseraDAO Exploit Minted 99 Million TSR, Stole 2.5 Million USDT en.bloomingbit.io
analysis Crypto Times — TesseraDAO TSR mint exploit cryptotimes.io
analysis softstack — TesseraDAO TSR infinite-mint/admin-key incident softstack.io
analysis KuCoin — TesseraDAO TSR exploit kucoin.com

Understand the attack patterns

Compare incidents →

Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes