DIP token hack — June 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | June 17, 2026 |
| Target type | Token contract |
| Loss | $111,098Price at time of incident |
| Method | Contract logic errorDIP's sell fee, combined with a double transfer through the router, let the attacker shrink the DIP/AIC pair's DIP reserve with skim and sync and swap the remainder for nearly all of the pair's AIC |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
DIP, a token on BNB Chain, lost the AIC side of its DIP/AIC pool on 16 June 2026, in a transaction at 16:28:38 UTC; the attacker turned it into 111,097.60 USDC. TenArmor flagged it the next day, putting the loss at about $111,100.
According to a DeFiHackLabs reconstruction, the attacker flash-swapped AIC and used DIP's sell fee together with a double transfer through the router to shrink the pair's DIP reserve with skim and sync, swapped its remaining DIP for nearly all of the pair's AIC, repaid the flash swap and swapped the leftover AIC into USDC.
This registry read the receipt: the pair lost about 10.04m AIC, and 111,097.60 USDC reached the attacker's address. That amount is recorded. No statement from the project has been found.
Sources
- TenArmor on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- BNB Chain transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "DIP token hack — June 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/dip-token-bsc-june-2026https://itokenly.com/hacks/dip-token-bsc-june-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.