Attacker Steals 21 Million TAP Tokens as TapiocaDAO Loses Up to $38 Million in Exploit

Oct 18, 2024, 11:07 AM

On October 18, 2024, TapiocaDAO, a decentralized finance (DeFi) platform, was exploited due to a private key compromise, resulting in losses estimated at up to $38 million. The attacker compromised the deployer address, changed the owner of the vesting contract, and withdrew over 21 million TAP tokens. The stolen TAP tokens were swapped for approximately $1.5 million worth of ETH. The attacker also minted a large amount of USDO, which was swapped for USDC, and withdrew and sold TAP tokens from multiple vesting contracts. Stolen funds have been bridged to other networks. Users are urgently advised to revoke approvals for TAP and TapUSD tokens and avoid interacting with the compromised contracts until further notice.