GYM Network deployed a new contract function on June 6, 2022. On June 8, attacker exploited missing caller verification in depositFromOtherContract() to create deposit records without actually transferring tokens, inflating balance and draining approximately 2,475.91 WBNB (~$716K). Funds were laundered through Tornado Cash.

GYM NETWORK Hacked, Lost $2.1M, Stolen Funds Moved to Tornado Cash. According to the official Twitter account, the attack was caused by an attack on the Claim & Pool function, which resulted in a significant price drop.