ATM Token exploit analysis
ATM Token's `transferFrom` ran a hidden auto-swap inside the same call, crediting the receiver with an inflated stable while the attacker retained the in-pair token. DeFiHackLabs reconstructs about $243,543 USDT drained from the ATM/USDT PancakeSwap pair.
- Reported loss
- ~$243,543 USDT, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-04: Hidden Transferfrom Auto Swap Drain on ATM Token”.
Analysis1 min read
The ATM token contract had a transferFrom that swapped out a fee-on-transfer token via a hidden auto-swap path inside the same call. The attacker called transferFrom with the right receiver, the contract auto-swapped the inbound fee-on-transfer to a stable, and credited the receiver with the inflated stable balance. The receiving side retained the full ATM balance for the attacker.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; the project is unverified and the loss is approximately $243,543 USDT (gross drained from the ATM/USDT PancakeSwap pair).
What would have prevented it: separating the transferFrom from any auto-swap, or making the auto-swap explicit in the receiver's balance accounting rather than implicit in the contract.
Other exploits
- BOSS exploit analysis 6 Jun 2026
- AISOTHPresale exploit analysis 5 Jun 2026
- DTXT exploit analysis 5 Jun 2026
- BYToken exploit analysis 4 Jun 2026
- The Kiss exploit analysis 2 Jun 2026
- AROS exploit analysis 30 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
