LegendaryMoneyMonNft exploit analysis
LegendaryMoneyMonNft's `cliamRewred()` trusted a verify() predicate and paid out the requested ERC20 amount without checking it against the user's recorded balance. DeFiHackLabs reconstructs about $85.5K USDT drained.
- Reported loss
- ~$85.5K USD (85,519 USDT), per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-28: Ecrecover Address0 Signature Bypass on LegendaryMoneyMonNft”.
Analysis1 min read
LegendaryMoneyMonNft's claimRewred() (note the typo in the source) verifies via a verify() predicate that returns true when the user is owed any reward, then releases the verified payment token for the requested amount. The verify step did not constrain the requested amount against the actual payment token balance of the user. The attacker repeatedly submitted reward claims for the entire payment token balance, draining it.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; total loss is approximately $85,519.47 USDT (~$85.5K).
What would have prevented it: capping claimRewred() at the user's recorded reward balance plus any explicit bonus, with the contract not trusting the verify() predicate beyond that.
Other exploits
- DxSale exploit analysis $7.3M
- YSDAO exploit analysis 29 May 2026
- DxSale exploit proof of concept 28 May 2026
- Joe Agent exploit analysis 27 May 2026
- SKP Token exploit analysis 26 May 2026
- New Market Trading exploit analysis 25 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
