On June 4, 2026, ATM token on BSC was exploited for $243K via improper loop control in automatic swap-on-transfer mechanism. Contract was designed to convert 20% of transfers to BSC-USD, but flaw allowed repeated triggering beyond standard limits.

The ATM token on BSC was exploited due to a flaw in its custom transferFrom() function logic (which automatically swapped ~20% of transferred amounts to BSC-USD). The attacker repeatedly triggered the mechanism to drain approximately $243,500 from the protocol.