An attacker called a vault function on Crypto DAO's Pro token contract on BNB Chain that had no access-control modifier, draining ~$8.2M in USDT. Funds were split across three addresses holding ~$2.68M, ~$2.69M and ~$2.78M.
On July 28, 2026, an attacker called a vault function on Crypto DAO's Pro token contract on BNB Chain that had no access-control modifier, draining ~$8.2M in USDT. The funds were split across three addresses holding ~$2.68M, ~$2.69M and ~$2.78M from primary attacker wallet 0x427671b2C8e91034A91FE698F9B7259b2345F45D. Flash loans scaled the attack within a single block but did not create the flaw. Blockaid flagged the exploit in real time and SlowMist classified it as a smart-contract vulnerability. No post-mortem or recovery plan was published.
The ~$8.2M in USDT was split across three addresses holding ~$2.68M, ~$2.69M and ~$2.78M. No post-mortem or recovery plan was published.