EOSCast gaming contract was exploited via a fake EOS token attack. The attacker created a malicious token contract named 'EOS' and launched 17 transfer attacks of varying amounts (100, 1,000, and 10,000 counterfeit tokens). The contract failed to verify the token issuer, allowing the hacker to extract 72,912 real EOS from the bonus pool.

The hacker "refundwallet" tried to attack the EOSCast game contract "eoscastdmgb1". The hacker first used the "fake EOS" attack method to conduct 8 transfer attacks, but failed, and then successfully attacked 9 times by using the "fake EOS transfer variant". According to the rules of the game, hackers launched attacks with 100, 1,000, and 10,000 fake EOS. Each attack can get 198, 9,800, 19,600 EOS. When the last attack was carried out, the game party noticed an abnormal attack and transferred it in time. After leaving the remaining 8,000 EOS in the bonus pool, in the end, the hacker made a total of 72,912 EOS.