Tapioca DAO hack — October 2024

Tapioca DAO ran an omnichain money market and the USDO stablecoin, deployed principally on Arbitrum with contracts also on Ethereum. At 10:09 UTC on 18 October 2024 an attacker obtained the private keys of a core contributor who still held admin roles on live contracts.

According to the DAO's post-mortem, the contributor was approached through LinkedIn and Telegram by an attacker using a fabricated recruiter identity and a fake job offer, and was persuaded to run a malicious file that installed credential-stealing code and exposed his keys. The post-mortem states he had repeatedly been told to move the admin roles to the DAO's 4-of-7 multisig and had not done so. With those roles, the attacker added a minter to the USDO contract, issued a very large unbacked supply and swapped it for USDC out of the USDO liquidity pools, and separately withdrew TAP tokens from the vesting contract through an emergency rescue function and sold them for ETH. TAP fell about 96 percent.

Figures differ. The DAO's post-mortem puts the loss at roughly $4.65 million, about 605 ETH and 3.1 million USDC. Halborn reports about $4.4 million, 591 ETH and 2.8 million USDC; other coverage cites $4.7 million. Part of the proceeds was bridged to BNB Chain via Stargate.

Tapioca offered the attacker a $1 million USDT white-hat bounty, which it revoked on 22 October. Its post-mortem records about $2.65 million retrieved through a counter-exploit run with EnigmaDark Labs, plus roughly $700,000 recovered from Uniswap v3 pools. The contributor was terminated and his and the Pearl Labs founders' contributor token allocations were revoked. The post-mortem attributes the intrusion to a North Korean group, based on an identification by SEAL911; Halborn separately notes the fake-recruiter lure is a method commonly associated with the Lazarus Group. Neither amounts to a formal attribution.