YSDAO exploit analysis
YSDAO's reward multiplier reset against an inflated total supply, so a single mint drove the multiplier in the attacker's favour and the wrong-multiplier reward was harvested. DeFiHackLabs reconstructs about 19.49K USDT drained.
- Reported loss
- ~19.49K USDT, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-29: Price Manipulation And Tax Bypass on YSDAO”.
Analysis1 min read
YSDAO's reward distribution counted YSD staking rewards at the wrong multiplier when the multiplier's calculation was reset against an inflated total supply. The attacker minted just enough YSD to drive the multiplier in a single transaction, harvested the wrong-multiplier reward, then unwound.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; the drain is in 0x91f26d96373bbec6a6a8517c7be995a739d65f20fed589d53bc47d8140f91907 on BscScan for a total loss of about 19.49K USDT.
What would have prevented it: a multiplier that is set against a known-staked-amount rather than against a total supply that the same actor can move.
Sources read (3)
Other exploits
- AROS exploit analysis 30 May 2026
- Gravity Bridge exploit analysis $5.4M
- DxSale exploit analysis $7.3M
- DxSale exploit proof of concept 28 May 2026
- LegendaryMoneyMonNft exploit analysis 28 May 2026
- Joe Agent exploit analysis 27 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
