Leaderboard
979All-time rank
S
SKYDAO
Sep 30, 2026
$183K
Lost
$183K
Recovered
$0
Net loss
$183K
Unrecovered0% recovered
SKYDAO’s taxed sell flow called its pool controller before the seller’s net tokens were credited to the PancakeSwap V2 pair. sync(), causing the pair to record an almost-zero SKYDAO reserve.
swap() to extract USDT liquidity.
How the exploit worked
View reproducible PoCswap drains for the pair's entire USDT.
Lost: 59,914.12 USDT net to the attacker (exactly reproduced) on BNB Chain; the SKYDAO/USDT PancakeSwap V2 pair lost its entire 183,482.88 USDT reserve, drained by…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Swap Logic Flaw
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Sep 30, 2026Exploit executed — $183K drained via swap logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)