On January 19, 2023, Thoreum Finance on BSC was exploited through a logic flaw in the transfer mechanism. An attacker deposited BNB to gain WBNB, then used the swapExactTokensForTokensSupportingFeeOnTransferTokens function to exchange for THOREUM tokens, exploiting a branch in the transfer logic to profit approximately 2,260 BNB (~$65.5K).

Thoreum Finance was hacked. According to analysis, because the transfer function of the non-open source contract 0x79fe created by the Thoreum Finance project party is suspected to have a loophole, when the from and to addresses of the transfer function are the same, due to the use of temporary variables to store the balance, the balance will double when you transfer to yourself , the attacker repeated the operation many times, and finally made a profit of 2,000 BNB, involving an amount of about 580,000 US dollars.