What happened
On 7 April 2022 an attacker abused WonderHub, the in-house bridge that moves the WonderHero game's WND token between Polygon and BNB Chain. By getting past the bridge's risk-control checks, the attacker had the back-end signature server approve a withdrawal and minted 80 million WND on BNB Chain. The tokens were sold on PancakeSwap for about 744 BNB, roughly $320,000 at the time, and the proceeds were moved through Tornado Cash within a few hours. WND fell more than 90%.
WonderHero took the game and website offline, said WND on Polygon, HECO and in game accounts was unaffected, and planned a new WND contract with an airdrop to BNB Chain holders and liquidity providers based on a snapshot taken before the attack.
How it happened
- WonderHub bridges tokens by burning them on the source chain and minting the same amount on the destination chain, with a back-end signature server authorizing each withdrawal.
- The attacker got around WonderHub's risk-control module and reached the cross-chain withdrawal interface for BNB Chain.
- Through the signature server and the BNB Chain
WNDminting contract, the attacker minted 80MWNDwithout a matching burn on the other chain. - At 07:05:27 UTC on 7 April the attacker sold the 80M
WNDon PancakeSwap for 744.374 BNB (tx0x20dabda59dd46d45a7b6b5b324830159fb108cd2119232d7f0056d8085de17e1). - Between 10:34 and 10:40 UTC the BNB was deposited into Tornado Cash.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
