On October 27, 2022, UvToken's mining pool contract on BSC was exploited via a logic error in the withdrawal mechanism where input validation failed to authenticate the caller, allowing an attacker to make malicious calls and seize approximately 1,078 BNB and 1,161,991 BUSD (~$1.5M) from the vault.

The UvTokenWallet Eco Staking mining pool contract was hacked. The key reason for the vulnerability is that the mining pool contract withdrawal function does not strictly judge the user input, so that the attacker can directly pass in the malicious contract address and use the malicious contract to empty the relevant funds. SlowMist MistTrack conducted a traceability analysis of the funds: so far, hackers have transferred a total of 5,011 BNB of profit to Tornado Cash. In addition, the source of the attack fee is also Tornado Cash.