Leaderboard
465All-time rank
Pond0x
Jul 28, 2023
$2.2M
Lost
$2.2M
Recovered
$0
Net loss
$2.2M
Unrecovered0% recovered
Pond0x's directTransfer() function allowed any account to transfer tokens from any other address without authorization. The function exposed an internal _transfer function with no access controls, enabling attackers to drain funds by moving tokens from any address to their own.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jul 28, 2023Exploit executed — $2.2M drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%