On May 4, 2022, MM.Finance's DNS infrastructure was compromised, allowing attackers to inject a malicious contract address. Users interacting with swap, add liquidity, or remove liquidity functions had their funds siphoned to the attacker's wallet. Approximately $2M in CRO was stolen and laundered through Tornado Cash to OKX.