Date: June 24, 2026
Chain: BNB Chain
Loss: 226,119.12 USDT, about $226K, the DLMC contract's entire USDT reserve
Class: price formula that leaves contract-held tokens out of the supply
The attacker who drained DLMC Token on June 24, 2026 sold just 65,908.69 DLMC to do it. Those tokens had arrived a few moments earlier as a referral bonus, and the DLMC contract bought them back at nearly $25 each, paying out 1,646,119.12 USDT from its reserve. According to Defimon's alert, the same token had been priced at about $0.10 before the transaction started.
Everything happened in one transaction at 11:15:10 UTC. A flash loan funded two large purchases, the purchases pushed DLMC's internal price from about $0.10 to about $25 by Defimon's count, and the bonus tokens were sold at the new price. The contract's price formula divided its USDT reserve by the supply held outside the contract, and every purchase grew the reserve while sending most of the newly minted tokens to the contract itself, where the formula didn't count them.
DLMC didn't trade against an outside pool for its main price. According to Defimon, it ran an internal bonding curve: the contract held a USDT reserve, sold newly minted DLMC to buyers through buy(), and bought DLMC back through sell(), with a live price recalculated in a function called _updatePrice(). Buyers could register under referrers, and the contract's referral and level logic paid bonus tokens up the chain whenever someone below made a purchase.
Defimon gives the formula as livePrice equal to the USDT reserve divided by circulating supply, where circulating supply leaves out the tokens the contract itself holds. Crypto Times describes the same rule as reserves divided by external supply only. Crypto Times notes the project had claimed its ownership was renounced, and the DLMC contract's owner function does return the zero address.
Each purchase put USDT into the reserve and minted new DLMC, but the exploit transaction shows that nearly all of the new tokens went to the DLMC contract's own address. That raised the numerator of the price formula by the full purchase while barely moving the denominator, since the denominator skipped exactly the address receiving the new supply. A large enough purchase therefore raised the price for everyone who already held DLMC, including anyone holding bonus tokens they'd paid nothing for.
The lesson is that a price built from a ratio has to count every claim on the reserve in its denominator. Tokens sitting in the contract weren't out of circulation in any meaningful sense, because the same contract paid them out as referral bonuses, and once paid out they could be sold back against the reserve at the inflated price. It's like valuing a company's shares by counting only the ones outside the vault, while the vault keeps handing shares to employees who can sell them the same afternoon.
The attacker's wallet, 0x74C4a756933d0f713FacB1dEa325ef511646C3b1, deployed an attack contract that flash-borrowed 1,420,000 USDT from a PancakeSwap pair. According to Crypto Times and Defimon, it worked through two helper contracts registered as affiliates, the second one under the first.
The first helper, 0xe81bf6e392eca9ad594b5452ea53cf7071760a04, bought with 420,000 USDT. The DLMC contract minted 865,163.19 DLMC to its own address and passed only small portions of it on to other addresses. The second helper, 0x8b5a72c4ce0d3a7676ce06b8e42aeb255bba476e, bought with 1,000,000 USDT, and the contract minted 1,839,009.85 DLMC to itself. Out of that second purchase, the contract sent 73,560.39 DLMC to the first helper, the upline bonus Defimon describes. Crypto Times reports the internal price rising to nearly $25 after the buys, from about $0.41 by its count.
The first helper then sold 65,908.69 DLMC back to the contract, staying just under what Defimon describes as a sell cap of four times the helper's investment. The contract paid 1,646,119.12 USDT for them and, according to Defimon, its reserve fell to 6 wei. Since the attacker had put 1,420,000 USDT in through the two buys, the contract's net loss was 226,119.12 USDT, which was everything it held before the transaction. The attack contract repaid the flash loan with 1,423,558.90 USDT and sent the remaining 222,560.22 USDT to 0x701bB7B460AE231dBbCFa3d87f0Ab5B458429699, the figure TenArmor and Crypto Times reported as the loss.
AMLBot reported on June 28 that the attacker had swapped the funds, bridged them to Ethereum through Li.Fi and Mayan Swift, and deposited 37 ETH into Tornado Cash in 10 ETH and 1 ETH notes. As of October 20, 2026, we hadn't found a post-mortem or recovery statement from the DLMC team.
Olympix reads DLMC as an attacker would, as states, transitions and entry points, and it takes in what the token is meant to do, sell and buy back against its own reserve with referral bonuses on top, to infer the invariants the code relies on but never states. The states that matter are the USDT reserve, the contract's own token balance and the supply held outside it, and buy(), sell() and the bonus logic are the transitions that move them. The engine flags the signal in _updatePrice(): a price computed from a balance anyone can increase with a purchase, divided by a supply figure that excludes the very address the purchase mints to.
The invariant fits in a sentence: no sequence of buys and sells in one transaction should let anyone withdraw more USDT from the reserve than they put in. BugPoCer works outward from that rule. It runs Counterexample-Guided Invariant Refutation, inferring the invariant from how buy(), sell(), the bonus payouts and the price update fit together, and executing paths until one breaks it. Paths that never move the price drop out quickly, and the ones left are those where a large buy is followed by a sale of tokens the seller didn't pay for.
The counterexample is the June 24 transaction, produced in development. Register one account under another, buy heavily through the second so the first earns bonus tokens while the price climbs, and sell those bonus tokens at the new price. BugPoCer reports that sequence with its minimal conditions, borrowed USDT and a two-level referral chain, plus a generated Forge test that replays it and shows the reserve emptying. It runs automatically as code is written, at every merge and before release, so a pricing change like this one shows up before the contract ever holds a reserve.
DLMC's reserve depended on one ratio staying honest, and the ratio left out the tokens most likely to come back for USDT. Pricing from total supply, or from supply that includes everything the contract can still distribute, would have kept a purchase from inflating the value of free bonus tokens. To see how Olympix tests the pricing and payout paths in your own contracts and hands back a runnable counterexample when one drains the reserve, book a technical walkthrough.
Protocol: DLMC Token
Chain: BNB Chain
Date: June 24, 2026, 11:15:10 UTC
Loss: 226,119.12 USDT net from the DLMC reserve (attacker profit 222,560.22 USDT)
Attacker EOA: 0x74c4...b3c1
Attack contract: 0x4adb...414e
Helper contract 1 (upline): 0xe81b...0a04
Helper contract 2: 0x8b5a...476e
DLMC contract (victim): 0xf2ca...bdf2
Flash-loan pair: 0x16b9...0dae
Profit receiver: 0x701b...9699
Exploit tx: 0x1510...1306
Block: 106091607
Defimon Alerts: DLMC Token Loss ~$226K
Crypto Times: DLMC Token on BNB Chain Loses Approximately $222,600 in Flash Loan Exploit