On April 12, 2022, Elephant Money on BSC was exploited via flash loan attack. Attacker borrowed 131K WBNB and 91M BUSD, manipulated ELEPHANT price via the manipulable oracle, and exploited insufficient flash loan guards in the TRUNK redemption mechanism to steal ~$22.2M.

Elephant Money was attacked, resulting in the loss of 27,416.46 BNB. The attacker first used WBNB to buy a large amount of ELEPHANT, and then used BUSD to mint the TRUNK stablecoin. During the minting process, the Elephant contract will convert BUSD to WBNB and then back to ELEPHANT to drive up the ELEPHANT price. The attacker then sells ELEPHANT at a profit.