On July 28, 2026, an unprotected exec() function in Crypto DAO's vault on BNB Chain allowed any caller to execute transfers, draining $8.2M USDT.

The Pro token contract of Crypto DAO was exploited due to missing access control, with the attacker calling publicly accessible vault functions. According to GoPlus Security’s analysis, the attacker’s actual profit was approximately $52,000, while the contract lost around 167,200 Pro tokens. The related addresses monitored by Blockaid collectively held approximately $8.2 million worth of USDT (not the actual stolen amount).