On October 25, 2022, ULME on BSC was exploited via a parameter validation flaw that lacked access control, allowing an attacker to use a flashloan, iterate through authorized spenders, drain their BUSD, manipulate ULME price, and extract approximately 50,646 BUSD (~$250K) before repaying the loan.