Holograph insiders minted $14.4M in HLG. Dough Finance’s unvalidated calldata cost users $1.8M. Loopring’s compromised Guardian 2FA led to $5M in wallet thefts. Meanwhile, TRUMP token rugged supporters for nearly $1M. Weak access control and broken trust vectors dominate July.
On July 12th, the Dough Finance exploit on the Ethereum Mainnet resulted in a $1.81M loss. The root cause was a lack of calldata validation in the deloopAllCollaterals() function in Dough Finance’s ConnectorDeleverageParaswap contract. The exploiter used unvalidated calldata during flash loan calls to manipulate data within the protocol’s contract. Dough Finance acknowledged the exploit and confirmed that the Dough Treasury would compensate the affected Users.
Exploit Contract: 0x9f54e8eaa9658316bb8006e03fff1cb191aafbe6
Transaction Hash: 0x4d52f0dad3ddb7ac5523c51a75a9acd47b244e536b240d692784305b69ca6ab5
On July 2nd, the TRUMP rug pull on the BNB chain resulted in a $958K loss. The scam targeted supporters of former President Donald Trump, who had recently announced his campaign would accept cryptocurrency donations. Following the rug pull, the token price dropped by 100%.
Exploit Contract (on BNB Chain): 0xbb4a4f59272b8304d81cb85774a5286f75ccdea1
Transaction Hash: 0x2ee9a9ceae28769564f0865241d83d1131972805c1035cc722995e201caca32b
On June 14th, the Holograph exploit on the Ethereum Mainnet resulted in a $14.4M loss. The root cause was a contract vulnerability exploited by an insider contact. The attacker deployed an unverified contract on Mantle to mint 1 billion HLG tokens. The Holograph team has acknowledged the incident and locked down the protocol. Bybit and KuCoin have frozen the exploiter’s accounts and suspended HLG transactions.
Exploit Contract: 0x740df024ce73f589acd5e8756b377ef8c6558bab
Transaction Hash: 0x0cc143ccf3316d47b36a2e45577922f4ebe2374966bb22c1e9cf49c747d46396
On June 9th, the Loopring exploit on the Ethereum Mainnet resulted in a $5M loss. The root cause was the compromise of Loopring’s 2FA service, which allowed the attacker to exploit wallets with the Loopring Official Guardian. The attacker impersonated wallet owners, reset ownership, and withdrew assets. The Loopring team has suspended Guardian and 2FA-related operations.
Exploit Contract: 0xbbbbca6a901c926f240b89eacb641d8aec7aeafd
Transaction Hash: 0xf0a02e3dc32e380f5fbc832981963277f7b2ce9345040ddf1f3016724b84e251