Leaderboard
1134All-time rank
W
WebKeyDAO
Mar 16, 2025
$73K
Lost
$73K
Recovered
$0
Net loss
$73K
Unrecovered0% recovered
WebKeyDAO's buy() function lacked proper access controls, allowing an attacker to purchase WKEYDAO tokens at artificially low prices set via an unprotected setTokenInfo() call. The attacker exploited this to acquire tokens at 1/10th market price and immediately sold them on DEX for profit, limited only by a built-in 67-token sale cap.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Mar 16, 2025Exploit executed — $73K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%