Leaderboard
748All-time rank
Merlin
May 26, 2021
$680K
Lost
$680K
Recovered
$0
Net loss
$680K
Unrecovered0% recovered
On May 26, 2021, Merlin Lab (PancakeBunny fork) was exploited for ~$680K via reward calculation flaw. Attacker deposited small amount, sent 180 CAKE to LINK-BNB vault, exploited getReward() function that calculated rewards from contract balance rather than user deposit, and repeated process 36 times.
Second $550K attack followed 8 hours later.
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Reward Logic Flaw
- Attribution
- Unknown
- Chains
BSC
Event timeline
- May 26, 2021Exploit executed — $680K drained via reward logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%