The attacker exploited a low-level access control flaw in the Swap-LP factory contract, transferring WDZD tokens from trading pairs to the factory address. This artificial manipulation inflated WDZD's value, allowing the attacker to trade WDZD for LP tokens at highly favorable rates and extract approximately 609 ETH (~$1M) by burning the LP tokens.

The DeFi protocol WDZD Swap on BSC was exploited and lost about $1.1 million. The attackers made nine malicious transactions that drained 609 Binance-Pegged ETH from contracts related to the WDZD project.