AirDAO

Social Engineering

Estimated loss

$1.05M

VERDICT —OUT OF SCOPE

Root cause is social engineering — privileged personnel deceived into authorizing the drain. Contract behaved as written. Defense lives in process controls (multi-party approval, M-of-N signoff windows), not in smart-contract review.

▰ METHOD

SOCIAL ENGINEERING

SOCIAL-ENGINEERING

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

The hackers gained access to AirDAO LP through a social engineering scam and drained the liquidity pool of AMB/ETH. The scam involved an email with a malicious attachment, impersonating one of their known partners. In total, the hackers stole 41,612,782.10627101 AMB and 126.5 ETH. Attack method (per SlowMist): Social Engineering. Reported loss: $ 1,050,000.

Primary source

https://twitter.com/airdao_io/status/1770855600756281390 ↗

Sourced from

slowmist

Technical record