DLMC token hack — June 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | June 25, 2026 |
| Target type | Token contract |
| Loss | $226,119Price at time of incident |
| Method | Oracle or price manipulationDLMCToken priced sales from its own manipulable reserves, so a second buy inflated the price before the attacker's first contract sold the maximum amount the token's USDT could cover |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
DLMC, a token on BNB Chain, lost 226,119 USDT from the token contract's own reserve on 24 June 2026, in a transaction at 11:15:10 UTC. TenArmor flagged it the next day, putting the loss at about $222,600.
According to a DeFiHackLabs reconstruction, the attacker used a PancakeSwap flash swap to buy DLMC through two registered contracts. The second purchase inflated the token's reserve-based live price, and the first contract then sold the largest amount of DLMC that the token's USDT balance could cover, draining almost all of it.
This registry read the receipt: the token contract lost 226,119.12 USDT, of which the attacker kept 222,560.22 after the flash-swap fee. The contract's loss is recorded, with the attacker's net as the lower end.
Sources
- TenArmor on XSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- BNB Chain transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "DLMC token hack — June 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/dlmc-token-bsc-june-2026https://itokenly.com/hacks/dlmc-token-bsc-june-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.