DAO Maker hack — August 2021

On 12 August 2021 an attacker drained roughly $7 million in USDC from a DAO Maker contract holding funds users had deposited for the launchpad's token sale rounds. DAO Maker said the same day that the loss came from "malicious use of one of our wallets with access to admin privileges". CoinDesk, citing on-chain data flagged by PeckShield, recorded 7,376,245 USDC moved from an address associated with the attacker to Uniswap, where part of it was swapped into 2,261 ETH. CoinDesk also reported that security analysts described the cause as a bug in a DAO Maker contract, so the mechanism is disputed between the company's account and contemporaneous analyst reporting.

DAO Maker put the number of affected users at 5,521, with an average loss of about $1,250. In an interview with Incrypted, chief executive Cristof Zaknun said two multi-signature wallets had been compromised, which allowed the attacker to create a fraudulent Smart Offering contract, and that the launchpad's vesting contracts were unaffected. He described the drain reaching depositors in tiers — roughly 30 accounts holding about $10,000, then around 100 holding about $5,000 — and said accounts below roughly $900 were not reached.

DAO Maker promised full compensation, airdropping 500 USDC to each victim and issuing "USDR" IOU tokens for the remainder, each stated to be worth 1.1 in DAO tokens one year after the airdrop. Cointelegraph reported in 2024 that redemption was never opened; that an October 2022 governance proposal instead cut redemption to 50% of par value, passing with 61.72% support that researchers said came from only six wallet accounts; and that victims it interviewed had still not been paid. Published totals range from the roughly $7 million DAO Maker itself gave to the 7,376,245 USDC observed on-chain. No arrests have been reported.