WebKeyDao Hack

On March 14, 2025, WebKeyDAO on BNB Smart Chain lost about $737,000 when an attacker bought wkeyDAO tokens from the project's sale contract far below market price and sold them on PancakeSwap. BlockSec Phalcon flagged the attack the next morning, March 15 UTC.

The vulnerable contract was 0xd511096a73292a7419a94354d4c1c73e8a3cd851. Its public buy() function sold tokens at whatever price and amount were stored in the contract's current sale settings. According to Verichains, those settings had been written through setSaleInfo() by the operator about 120 days before the attack. They let 230 wkeyDAO be bought for about 1,159 stablecoins, and a non-zero immediateReleaseTokens value delivered the tokens at once instead of vesting them. Verichains calls this an operational issue, possibly human error or a compromised operator key, rather than a code bug. Early reports described it as an unprotected buy function.

The attacker bought at the sale price and sold on PancakeSwap for about 13,167 per round, roughly ten times the cost, and repeated the cycle within the attack. The first reports put the loss at about $73,000; later analyses give about $737,000.

Attacker: 0x3026c464d3bd6ef0ced0d49e80f171b58176ce32

Attack transaction (per Verichains): 0xf13d281d4aa95f1aca457bd17f2531581b0ce918c90905d65934c9e67f6ae0ec