DAO Maker Vesting Hack - August 2021
The Initial Exploit (August 12, 2021)
On August 12 in the early hours (approximately 1 AM UTC), DAO Maker faced malicious use of one of its wallets with access to admin privileges. The admin's private key was used to grant the attacker's contract permission to withdraw funds from the exploited contract.
The cybercriminal first tested the exploit by stealing 10,000 USDC, then made 15 more transactions, siphoning approximately $7 million before the security team traced, contained and stopped the drain of funds. A total of 5,251 users were affected, losing $1,250 USD on average per user.
The Vesting Contract Exploit (September 4, 2021)
A second, related exploit occurred later. On September 4, 2021, DAO Maker's vesting contract was exploited, resulting in a significant loss of funds. Hackers took advantage of a vulnerability in the vesting contract where the init function was unauthenticated, allowing the attacker to initialize key parameters and change ownership, then steal tokens through the emergencyExit function.
Recovery Efforts
The team airdropped 500 USDC to all affected users without delay, and most affected users were to be refunded 30-50% of their losses on August 19. However, investors later reported that the project's promise to redeem compensation tokens for their stated value was never honored.
Sources