WealthManagementV2 Hack

Reported loss $26K
BNB Chain
Private Key Compromised

What happened

On September 8, 2026, the WealthManagementV2 contract on BNB Chain lost 26,414 USDT after an attacker took over its owner role. SlowMist said the ownership was suspected to have been transferred illegally, possibly through a leaked private key. As owner, the attacker used updatePlanConfig to set extreme plan parameters, which the contract accepted immediately because the function had no timelock and no bounds checks. That let the attacker mint inflated interest and withdraw it as USDT.

Attacker: 0xe439422afdd247503f75b4143c4a973eced04a36. Exploit transactions: 0x117d672359c3eaa81167a68613c0c7a85ea9127014d1f3e3cd6a6f0fe6a592fe and 0x66822644d63004ad6b06f64408518ba3ec567bf864f733cb982d3d8b9fe8c0d2.

How it happened

  1. Owner privileges on WealthManagementV2 passed to an attacker-controlled address. SlowMist suspects a leaked private key but has not confirmed how.
  2. The new owner called updatePlanConfig to set period=0 and interestMultiplier and unlockMultiplier to 528,300,000. The change took effect at once, with no timelock or limits.
  3. The attacker invested and redeemed in the same transaction, minting interest inflated by the huge multiplier.
  4. A second investment unlocked the inflated balance, and the attacker withdrew 26,414 USDT.

Protocol details

Classification Key Compromise
Protocol Type DeFi Protocol
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Ethereum NuNet $463K lost Polygon Polymarket $700K lost Solana DoodiPals $171K lost Wemix Wemix $6.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes