The MTDAO contract deployed on BSC was exploited on October 17, 2022 through a malicious function call that bypassed authorization checks. The attacker called transfer functions on both the MT and ULM tokens to extract 1,930 BNB and 487,042.615 BUSD, then routed funds through Tornado Cash.

The unopened contract 0xFaC064847aB0Bb7ac9F30a1397BebcEdD4879841 of the MTDAO project party was attacked by a flash loan, and the affected tokens were MT and ULM, with a total profit of 487,042.615 BUSD. The attacker used the functions 0xd672c6ce and 0x70d68294 in the unopened contract to call the sendtransfer function in the MT and ULM token contracts to profit (because they are both deployed by the project party, the unopened contract 0xFaC06484 has minter permission).