Ink Finance

Flash

Security

DLMC Token, associated with the Decentralized Legacy Management Corporation project on BNB Chain, experienced a treasury drain totaling roughly $222,560 in USDT on June 24, 2026. <a href="https://x.com/TenArmorAlert/status/2069957542109958498" rel="noopener noreferrer nofollow">TenArmor Security first flagged</a> the suspicious activity through its monitoring systems, alerting the community to the incident shortly after it unfolded around 11:15 UTC in BNB Chain block 106091607. The perpetrator used a flash loan to manipulate the protocol’s internal token price, allowing redemption of referral rewards at an inflated rate before repaying the loan and extracting the profit. 
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨">TenArmor Security Alert<img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨">
 Our system has detected a suspicious attack involving <a href="https://x.com/hashtag/DLMC?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#DLMC</a> on <a href="https://x.com/hashtag/BSC?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#BSC</a>, resulting in an approximately loss of $222.6K.
 Attack transaction: <a href="https://t.co/Xv6AsO63fQ" rel="noopener noreferrer nofollow">https://t.co/Xv6AsO63fQ</a>
 With TenArmor’s TenMonitor, you get early detection and automated response to on-chain… <a href="https://t.co/4UccmcQ0ka" rel="noopener noreferrer nofollow">pic.twitter.com/4UccmcQ0ka</a>
 — TenArmor <a href="https://x.com/TenArmorAlert/status/2069957542109958498?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 25, 2026</a>
</blockquote>
Vulnerable Contract: <a href="https://bscscan.com/address/0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2" rel="noopener noreferrer nofollow">0xf2ca2a3572b26ae7c479dc7ae36d922113b1bdf2</a> Attacker’s Externally Owned Account: <a href="https://bscscan.com/address/0x74c4a756933d0f713facb1dea325ef511646c3b1" rel="noopener noreferrer nofollow">0x74c4a756933d0f713facb1dea325ef511646c3b1</a> Profit Receiver Address: <a href="https://bscscan.com/address/0x701bb7b460ae231dbbcfa3d87f0ab5b458429699" rel="noopener noreferrer nofollow">0x701bb7b460ae231dbbcfa3d87f0ab5b458429699</a>
The attacker initiated a flash swap of approximately 1.42 million USDT from a PancakeSwap pair at <a href="https://bscscan.com/address/0x16b9a82891338f9ba80e2d6970fdda79d1eb0dae" rel="noopener noreferrer nofollow">0x16b9a8…eb0dae</a>. Helper contracts then executed large buys totaling over 1.42 million USDT worth of DLMC tokens. This significantly boosted the contract’s USDT reserves.
The protocol’s pricing logic calculated livePrice based on USDT reserves divided by externally circulating supply, excluding most newly minted tokens held by the contract itself. This caused the internal price to surge from around 0.41 USDT per DLMC to nearly 25 USDT. One helper address received referral or DAO reward tokens and sold approximately 65,908 DLMC back into the contract at the inflated price.
In total, the contract disbursed about 1.646 million USDT. After repaying roughly 1.424 million USDT for the flash loan, the attacker retained the net profit of $222,560. The root cause centered on the interplay between deposit functions that mint new DLMC primarily to the contract address and the _updatePrice mechanism, which did not account for those unminted or internal tokens in the circulating supply denominator. Referral rewards became immediately redeemable against the manipulated reserves.
DLMC operates as a decentralized finance protocol focused on legacy management and community-powered digital assets. Details on the project’s total value locked or broader user impact remain limited in immediate post-incident reporting, though the drain primarily affected treasury funds rather than external liquidity pools. The exploit also follows a broader pattern of treasury-focused attacks seen this year, including the recent <a href="https://cryip.co/ink-finance-suffers-140k-drain-on-polygon-attacker-exploits-treasury-proxy-via-whitelist-flaw-and-flash-loan/" rel="noopener noreferrer nofollow">Ink Finance incident</a> on Polygon, where attackers combined a whitelist flaw with flash-loan mechanics to drain protocol funds. Similar cases have highlighted how economic vulnerabilities can be just as damaging as coding errors.
This incident adds to a series of smaller-scale DeFi exploits in 2026 that have targeted economic design flaws rather than core smart contract access controls. Recent attack data suggests that these types of exploits remain persistent across the industry. According to a <a href="https://cryip.co/may-2026-crypto-hacks-report-84-2-million-lost-across-41-incidents/" rel="noopener noreferrer nofollow">report</a> covering crypto security incidents in May, hackers stole more than $84 million across dozens of attacks, with flash loans and protocol design weaknesses continuing to be recurring themes. Flash loan attacks continue to test protocols with self-referential pricing or reward mechanisms, particularly on chains like BNB where transaction costs facilitate rapid testing and execution.
The DLMC exploit also bears similarities to the attack on <a href="https://cryip.co/old-royalties-contract-on-polygon-attacked-261200-lost/" rel="noopener noreferrer nofollow">Royal’s legacy royalties contract</a> on Polygon, where a flaw in internal accounting enabled an attacker to extract funds without compromising private keys or administrative controls. Both incidents underscore the risks associated with flawed protocol logic and reward mechanisms. Project representatives had not issued a public statement at the time of publication.

DLMC Token on BNB Chain Drained of $222,500 in Flash Loan Price Manipulation Exploit

CRYIP

Other articles published on Jun 25, 2026

Join our free newsletter for daily crypto updates!