ShadowFi's SDF token contract had flaws allowing unauthorized token burning. Attackers exploited the access control vulnerability in a two-phase attack to burn all SDF tokens in the liquidity pool and drain liquidity.

Privacy project ShadowFi suffered a hack, and its official TokenSDF fell 98.5%. The attacker exploited the vulnerability of SDF to allow anyone to burn the Token, making a profit of about 1078 BNB (about $300,000), and the stolen funds have been transferred to TornadoCash.