EOS Max gambling DApp was exploited via a rollback attack on December 19, 2018, where attackers used EOS's blacklist functionality to revert blockchain transactions after betting outcomes were determined. The attack allowed players to recover bets even after losing. Multiple EOS gambling DApps were targeted simultaneously via this vector.

The attacker (eykkxszdrnnc) launched an attack on the EOS MAX game contract (eosmaxiodice), an EOS quiz game, earning a total of 55,526.05 EOS. The game party has suspended the game operation at 6:40 am on the 19th, and issued an announcement saying that it was caused by a loophole in EOS Node, not a loophole in the game contract.