tapioca.md

Tapioca DAO

Date:: October 18, 2024

Amount Stolen:: $4,700,000

Tags:: 🎙️ Contagious Interview

---

Onchain

• 0x008241806d8b56eacdb6a7e55b6d2244ef79fd00 - BSC POLYGON
• 0x042469a11d763b8a91f5322fa9b4bad7ee72a204 - BSC
• 0x05e0feff200f191221a2218b3f684772d29af6a5 - BSC
• 0x0bdc206300e2e2cd68659db36f8123d9c65df6ce - BSC
• 0x0dd6661b97e77701d206a3936b1ca3b23e481b50 - BSC
• 0x106ce91b57e7977feab3e6ad805dfdfcef393778 - BSC
• 0x129cfbf1bfb72552be87c60167f586bb5d4d6840 - POLYGON
• 0x1a9e0134bc4199dc8d8ea732583bec535f045be7 - POLYGON
• 0x1fe0ccf3a5b92f432b4772bdc031de915e74d210 - BSC
• 0x23e3185b7ced5735e00b12a2df0e9af2d40a6372 - BSC
• 0x23f367e9ced38ea8b782eb3616ad64a45252312a - BSC
• 0x2769c956f1560f43d259dba2d686a967ee934c2e - BSC POLYGON
• 0x2965917ed001ce957a282890a9c93abd281bef54 - BSC
• 0x2ba810802e6418e34ed4c6b2ef77f96cb8a655db - BSC
• 0x2e01f797b0593d0b4486d19f90de135b4bf46b31 - BSC
• 0x30ec55e70282ac3a032a3c7003ead8b79c76fde6 - ARB AVAX OPT
• 0x399b4f4d0d0482d4fb4040c2a26e5d7e912090d0 - BSC
• 0x3ab17c73723bf0d62cb4841b0299a06f416da92d - ARB AVAX ETH
• 0x3c6c7ddc1a1ef6af2546c8bb9d7c0b19c346f9b8 - ARB OPT
• 0x4112e7d665d19b09f15edcfe6d17443c05c5eab8 - BSC POLYGON
• 0x41310947b49423fbd6f749fc321557908a69e05c - POLYGON
• 0x4158a44323f80b32a5fef5b9d51f9cdb97691cf7 - BSC
• 0x42137e82d04d7cb19c8b5ba1916c68c8c0715f26 - BSC
• 0x42c9fc669dd7717ccca6002c40c2f194148016f8 - BSC
• 0x46a09b6115aef65fe05ca21af3c090382ac47770 - BSC POLYGON
• 0x472e47fa89c15215bccbcf764d6cee59c712e7d7 - BSC
• 0x4bb5738a4e4a9dc715ba40bcb424335e74d8a62c - POLYGON
• 0x55d398326f99059ff775485246999027b3197955 - BSC
• 0x55e54331d1305724884cdf9f573651885d8cd8b5 - ARB POLYGON
• 0x56c5dcdb62af1de68ef3a8febb7671c43b2c24f3 - BSC
• 0x5842d53c25b4af5abb61e44e01ac9e72303b4a83 - BSC
• 0x59533e61920c0a6aa72e8172a7b8c62b2a00c084 - BSC
• 0x5c65d1473253bd80fc0e040a86b6eef8403f9c78 - BSC
• 0x5ce6cea5c4c2ac648efaeb0169d8239eb355b4e1 - BSC
• 0x6102a0f580bb273487b12943e6081a0198e3f4bc - BSC POLYGON
• 0x62f053a88199b6f384b6960eeea74f36d37c0ea9 - BSC
• 0x6308c08345e72708dd4d0a5802f0c83c9aee710f - BSC
• 0x67f4cd4c60bc6a175cd5ca82b6af00c58524c30b - BSC
• 0x68916556717182d1526b6602c5926372af23dac0 - OPT
• 0x6974021122ee2447ae966e0329442c4f8a7392fb - BSC
• 0x69d91e56ca80f2a4d7b808b59053ea5c5505ffe2 - BSC
• 0x6b11d8a7b560360b6adc40767129d2fa14988740 - OPT POLYGON
• 0x6b28e0938a4f670d4fda0735bf61bc7f4216f069 - POLYGON
• 0x70285a11489bed93686410ebc727057cafb8129d - ARB
• 0x717f4d449af89859a1285ea204e58a83c41cb25e - BSC
• 0x736fd9653a98bff65233ff2589b6d61f09030944 - BSC
• 0x74419a837939e19c150978f29a6361fafaf96c5f - BSC
• 0x74b50e506cc2c76ff426dbdeb06b8df3dffdfad6 - BSC
• 0x7fbab3ff05cf1aec69df7efa3121323593027636 - POLYGON
• 0x80a493abac6c59f151e99a87b1e43a627cbf515d - BSC
• 0x80cede92e2979d4ee391a0b146d62e16d19d318d - BSC
• 0x87dfb8a0aa0c7b61b7fcd943a525382dd75ac674 - BSC
• 0x88fb35a23a12fa1950252a17abbaa4724ccc24eb - POLYGON
• 0x8a22c4602df90ecdea45d3695af8a700df1dfb06 - BSC
• 0x94633c084808c3db7a928de0579f718e1e417b4c - POLYGON
• 0x968043a76f427de791ae956dfef06d04bfd18c1b - BSC
• 0x97bbef2ffd204e08291fd2819c5b05e3953304cf - BSC
• 0x9ace57f5032ae4b99cdf4c7ba46c29b3ab2fa495 - POLYGON
• 0x9c5fdcaee74b9fce68b555d3d5cb9454e2a258b4 - BSC
• 0x9e8897ca90dd1937bbe2e77c36e1409140c861c5 - ARB
• 0x9e96119449d3c594534dde67c0eb8ad8b1a1b5d8 - BSC
• 0x9e9851504d4ec501dd3046266b2d8992a221b5d8 - BSC
• 0xa029da4b3ea1e850d5b988814aae76e7c3363ce1 - POLYGON
• 0xa1e77aa3dab09902726a4f2107aafe707f46d6ac - BSC
• 0xa4add1e0fa669308bc05b0c96776036902466ec9 - BSC
• 0xa4b5ebeb8a3058eb13f6e573f34f27c81d0d3ea4 - BSC
• 0xa99e3f8939abc3b2c25601da48c823fc3e173d34 - BSC
• 0xa9f662f6a3b9865559ed54fce4bb4371407ad426 - BSC
• 0xaedb15c192550c6875f5b210dd8f53489e71c6f4 - BSC
• 0xb2cb6a236c2e6ecf04734e841e0a9f1e872349b5 - BSC
• 0xb5df235f1351299078b4f29cca3f4a9427e19ecc - BSC
• 0xb63815ceb75ab0645bd914e61f7db8c76fe225e7 - OPT
• 0xb815a9e81faae5835ab813ab801593a51bc45ea0 - BSC
• 0xbf2b141bde5338e181504695dd4a6a4cc2da4906 - BSC
• 0xc461562cdf1c5a35ebc9bbbc1f4e4e1c8bbfe46b - BSC
• 0xc55e826d80214d5a709e90282872efb110e9f146 - ARB
• 0xc560e883d754dafa224297023fa6e7f318adbe14 - BSC
• 0xc6ebe84564291c80c387cd04bf01c1c884e67e56 - OPT POLYGON
• 0xc703dbe9e6ef729c31e32f4355bc28852abf9d0d - POLYGON
• 0xcb7419c5f3da0ede4f7c6d5b01f858fc22f36d0a - BSC
• 0xcd163138c1137cc03f23bbd3f627cfdd267d3f7a - BSC
• 0xcf2e155eaa30706ff245679838006e6e092dd8b5 - ARB
• 0xd039032e9542a719cec52e1605ca38d94ca07462 - OPT
• 0xd287e8126d60e3a233166aa5721823501ce58f8b - BSC
• 0xd2deeda0abbc291a2549eb341fdf6ec6b74f4376 - BSC POLYGON
• 0xdf4544a82d78964ba29e17dafae6c9370f5b4087 - POLYGON
• 0xe254c1eaa2dc0ae9479ae18d1497f64e22828ba0 - BSC
• 0xe6254ba50f41df7f2abc659a00256b26c32bd81e - POLYGON
• 0xeaf9f533871b07b151883908b4fb6eef4b51a95f - AVAX
• 0xeb0534127ceab051cc19d0b57a38b0975ad8fd9c - BSC
• 0xeec7c9ea3f8efebf6c5247dcaea545d0d9b5e063 - BSC
• 0xeee9cccfb024ce72861784622ec1ed71d5b89003 - POLYGON
• 0xf6751c1ecc466ee4dc1619397ffb90bd4065a32b - BSC
• 0x38cbcd3fbbf8f591dbf1c930badc74db6cba7f7a - BSC
• 0x7dde9fa46ff9ef59976f4df88eec4f68ee1bb7e9
• 0xb6c931c69d47b6c797177f47fd1b61061775791d
• 0x5800aebe6af65f4cdc57b2a029bbd0951df7b8a2
• 0xfd086bc7cd5c481dcc9c85ebe478a1c0b69fcbb9
• 0xa3b4abdf7bb59038904a6df33eefc0636cc66e4c
• 0x69a835c6b8b6cddf61f90d6cb550f696207027e1
• 0xfb984ee052a4a0ddd1b860209102c7c1485e59be
• 0xd9f89cf6fb7c3adaf6446a80c23fcd22f8ef69b8
• 0xf57c19b18ba8b0f8d6dfd464a9d649e6ca6e1802
• 0x9ee158a3fd12680f71bc7d470ebbf0b7ed99be00
• 0xadb6a90df94aedc62cdc8014849bca1a5b8ab614
• 0x95669988906c23abb64dfcf03b106b70f3a2fde4
• 0xb106689bdd8ca9c46e6b0e4520e5aa86ce10a4e5
• 0xd94b2c4f4d3eee95c3851573b7c494bc42b5eeb8
• 0xaf49bf5fc4f7bbf02ddfb5a5eb1bdd8b5ade49ce
• 0xfef3e56083132364f9809a889c68712df7787071 -- also receives from DPRK IT Workers @ 0x38a35ab4235ce7c8b5c4733cee7de9e28e348acb

Details

Theft is tied on-chain to other recent hacks such as Nexera, Concentric, Masa, SpaceCatch, Reach, Serenity Shield, MurAll, etc I have previously covered which were the result of fake job scams (contagious interview)

Stolen funds from this incident were bridged from Arbitrum to BSC where ~$4.7M currently sits.

• ZachXBT

On-chain

• 0x70285a11489bed93686410ebc727057cafb8129d

• 0x69d91e56ca80f2a4d7b808b59053ea5c5505ffe2

• TAP Vesting Contract: https://arbiscan.io/address/0x2997c5ddd3070a46e9938261ce0a16a237121cb0#code

• Exploiter: https://arbiscan.io/address/0x70285a11489bed93686410ebc727057cafb8129d

• Stolen funds were bridged from Arbitrum to BSC: https://bscscan.com/address/0x69d91e56ca80f2a4d7b808b59053ea5c5505ffe2

• Attack Transaction 1: https://arbiscan.io/tx/0x8cf8def40fa2beab66f46863478bea71ad8f4512003caf2fa639cc5a00550753

• Attack Transaction 2: https://arbiscan.io/tx/0x1abb8cf0b0af2ce19a30ce5103d51269d4600d9aeba045260feb588db89d76a4

• Attack Transaction 3: https://arbiscan.io/tx/0x174c3deaf563be1bb6d873ba279421e8588acc888ef672bafd5efe7441aae74f

• USDO Stablecoin Contract: https://arbiscan.io/token/0xeb99062643ca5ab880c077288345e0b14b297432

• USDO Infinite Mint Exploit: https://arbiscan.io/tx/0x0bca43cfb5b14ea039f2b329cb6074383d54ed8240963014ccb6400befa5a4e3

URLs

• https://rekt.news/tapioca-dao-rekt/

• https://www.theblock.co/post/322061/tapioca-dao-stops-1000-eth-worth-2-7-million-from-being-stolen-following-exploit-that-drains-majority-of-its-funds

• https://twitter.com/0xTeun/status/1847235350915145888

• https://twitter.com/zachxbt/status/1847249205720408138

• https://twitter.com/tapioca_dao/status/1847330264139145361

• https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/

• https://t.me/investigations/167