Odin.fun hack — August 2025

Odin.fun, a Bitcoin-based memecoin launchpad, lost 58.2 BTC — about $7 million at the time — in an attack on its internal automated market maker in mid-August 2025. Platform bitcoin deposits fell from 291 BTC to 232.8 BTC in under two hours.

The mechanism was price manipulation inside the AMM rather than an external oracle. PeckShield, which first flagged the drain, and a later technical write-up by QuillAudits describe the attacker depositing effectively worthless tokens, including SATOSHI, into pools alongside BTC and then self-trading to push those tokens' bitcoin-denominated price far above any real market value. Withdrawing liquidity at the manipulated ratio returned far more bitcoin than had gone in. QuillAudits identified the SATOSHI/BTC and ODINPEPE/BTC pools as the ones drained and published two platform account identifiers it attributed to the attacker.

Co-founder Bob Bodily said the flaw had been introduced in the platform's most recent AMM update and blamed "several malicious users, primarily linked to groups in China". No individual or group has been named or charged. Odin.fun halted trading and withdrawals, commissioned an external code audit expected to take about a week, contacted US law enforcement and worked with Binance and OKX. Bodily said the company treasury was not large enough to cover the loss, that remaining platform funds were safe, and that a compensation plan would follow; a public message to the attacker offered "a short window to return the funds".

Sources differ on timing: QuillAudits and several outlets place the drain on 12 August 2025, while The Block and CoinDesk reported it in the early hours of 13 August UTC. No recovery has been reported.