Leaderboard
555All-time rank
L
Levyathan
Jul 30, 2021
$1.5M
Lost
$1.5M
Recovered
$0
Net loss
$1.5M
Unrecovered0% recovered
Levyathan developers stored private keys with minting capability on GitHub. The attacker used these to pass a timelock transaction on July 28 and execute an ownership transfer on July 30, minting 100 quintillion LEV tokens.
The weak timelock controls lacked multisig authorization.
How the exploit worked
View reproducible PoC(I) Lost keys and minting (II) Vulnerable emergencyWithdraw.
Lost: $1.5 million
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Frontend & Infrastructure
- Technique
- Key Stored Publicly
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Jul 30, 2021Exploit executed — $1.5M drained via key stored publicly
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)