Mosca is an on-chain MLM/membership program where users join by depositing USDT, BUSD, or USDC for internal credits to withdraw later. The exitProgram function had incomplete state resets—only user.balance was zeroed after withdrawal but not user.balanceUSDT and user.balanceUSDC, enabling repeated withdrawals of the same funds from these alternate balance fields.

Mosca was reportedly attacked on BSC, resulting in an approximate loss of $19,500.