Token

DeFi

Security

Tornado

TesseraDAO, a decentralized finance project on BNB Chain, has been hit by a severe security incident that has effectively destroyed the value of its governance and utility token, $TSR.According to alerts from blockchain security firm <a href="https://x.com/PeckShieldAlert/status/2061713210210988434" rel="noopener noreferrer nofollow">PeckShieldAlert</a> and on-chain investigator Specter, an attacker minted approximately 99 million TSR tokens through the project’s smart contract. The exploiter then rapidly sold the newly minted tokens on the market, extracting around $2.5 million in USDT. The stolen funds were subsequently bridged from BNB Chain to Ethereum, after which 1,285.5 ETH was laundered through the privacy mixer Tornado Cash. 
<blockquote class="twitter-tweet">
 <a href="https://x.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> Specter has reported that 99M <a href="https://x.com/search?q=%24TSR&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$TSR</a> was minted and dumped (-99%) on <a href="https://x.com/hashtag/BNBchain?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#BNBchain</a> ~19 hours ago <a href="https://x.com/TesseraDao?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@TesseraDao</a>.
 The exploiter swapped the <a href="https://x.com/search?q=%24TSR&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$TSR</a> for ~2.5M <a href="https://x.com/search?q=%24USDT&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$USDT</a>, bridged the stolen funds to <a href="https://x.com/hashtag/Ethereum?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Ethereum</a>, and has already laundered 1,285.5 <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> via <a href="https://x.com/hashtag/TornadoCash?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#TornadoCash</a>. <a href="https://t.co/6cXKDyQi9l" rel="noopener noreferrer nofollow">pic.twitter.com/6cXKDyQi9l</a>
 — PeckShield <a href="https://x.com/PeckShieldAlert/status/2061713210210988434?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 2, 2026</a>
</blockquote>
The exploit address associated with the incident is <a href="https://bscscan.com/address/0x2201037A1755eC48eC5f00Fea21A10A9E56f2Dd8" rel="noopener noreferrer nofollow">0x2201…f2Dd8</a>. Security researchers and on-chain analysts strongly suspect that this was not a conventional external hack but rather an insider attack or the exploitation of a hidden backdoor. Reports indicate that minting privileges and certain critical functions (including MultiTransfer) were controlled exclusively by deployer-related addresses. Some analysts have described it as a rug pull-style operation executed via compromised or privileged access.This incident highlights a recurring vulnerability in smaller DeFi projects: the presence of centralized minting capabilities and privileged administrative functions in smart contracts, which can be catastrophic if the controlling keys are compromised or misused.
The TesseraDAO exploit also comes amid a wider wave of BNB Chain-related security incidents in 2026. In a separate attack reported recently, DxSale’s legacy liquidity lockers were drained of approximately <a href="https://cryip.co/dxsale-legacy-liquidity-lockers-drained-of-7-3-million-on-bnb-chain/" rel="noopener noreferrer nofollow">$7.3 million</a> after attackers exploited weaknesses tied to outdated locker contracts, further raising concerns about poor contract architecture and centralized controls across smaller DeFi ecosystems.
The massive dump of minted tokens caused $TSR to lose nearly 99% of its value within hours. The token price plummeted to microscopic levels (around $0.0002), with liquidity drying up and trading volume collapsing. Retail investors holding the token have suffered significant losses, and the project’s market capitalization has been virtually wiped out.As of the latest updates, the TesseraDAO team has not issued any official statement regarding the exploit. The project’s website and social media channels remain silent on the matter, leaving the community without clear guidance.
This exploit adds to the list of security incidents that continue to plague smaller DeFi protocols in 2026, even as larger institutional players push forward with regulated blockchain initiatives. While major platforms invest heavily in audits and security, many smaller projects still carry risks due to poor contract design, centralized controls, or insufficient oversight.On-chain investigators continue to monitor the movement of the laundered funds. It remains to be seen whether any portion of the stolen assets can be recovered or if the TesseraDAO team will take steps toward remediation, such as contract migration or compensation attempts.This story is developing rapidly. Further updates are expected if the project issues a response or if additional on-chain developments emerge.

TesseraDAO Hack Drains $2.5 Million as TSR Token Crashes Nearly 99% on BNB Chain

CRYIP

Other articles published on Jun 2, 2026

Join our free newsletter for daily crypto updates!