ATMBlindBox exploit analysis
ATMBlindBox derived randomness from the previous block's `blockhash`, which the attacker could pre-mine to predict the prize. DeFiHackLabs reconstructs the predictable-prize drain.
- Reported loss
- 99K USD, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-03-19: Weak Randomness Predictable Rng on ATMBlindBox”.
Analysis1 min read
ATMBlindBox's randomness was computed from the contract's blockhash of the previous block. The attacker pre-mined the previous block's hash and submitted a request whose outcome they could predict, capturing the prize every time.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: an oracle for randomness (Chainlink VRF) or a commit-reveal scheme that spans multiple blocks.
Other exploits
- Univ3CollateralToken exploit analysis 24 Mar 2026
- XocolatlLiquidator exploit analysis 24 Mar 2026
- BCE exploit analysis 23 Mar 2026
- Revamp exploit analysis 19 Mar 2026
- Fun.xyz CheckoutPool exploit analysis $86K
- StakeOnMe exploit analysis 15 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
