SafeMoon hack — March 2023

On 28 March 2023 roughly $8.9 million of WBNB was drained from the SFM:BNB liquidity pair on BNB Chain. A SafeMoon contract upgrade deployed the day before added a burn() function intended for bridging, but the function was left public and unrestricted, so any address could burn SFM tokens held by any other address. The attacker burned the SFM sitting in the liquidity pair, which raised the price of the remaining SFM against WBNB, then sold SFM back into the pool in the same transaction at the inflated rate and removed the pool's WBNB. PeckShield published the analysis. The exploit transaction. Chief executive John Karony said the team had "located the suspected exploit, patched the vulnerability, and are engaging a chain forensics consultant to determine the precise nature and extent of the exploit", and said the incident hit the SFM:BNB pool rather than user wallets. The address that carried out the drain said it had front-run the original attacker's transaction unintentionally and offered to hand the money back. After negotiation SafeMoon said the exploiter would return 80 per cent and keep 20 per cent. On 20 April 2023 two transfers of 10,000 BNB and 11,804 BNB, together about $7.2 million, reached a SafeMoon wallet. Nobody has been identified. This exploit is separate from the federal fraud case against SafeMoon executives, in which Braden John Karony was convicted in May 2025 and sentenced in February 2026; that prosecution concerns insiders' own use of the liquidity pools and does not address the March 2023 attack.