← ATM Token BNB Chain Exploitreviewed 2026-10-16 · 12 claims checked
Fact-check findings
What an automated fact-checker found when it re-read ATM Token BNB Chain Exploit against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #9[unverifiable][awaiting moderator]in section: Project Response and Aftermath
“No regulatory body has filed charges or issued a public notice related to this incident as of the time of this investigation.”
reviewerNo regulatory body has filed charges or issued a public notice related to this incidentNo sources specifically cited for this claim, and a targeted search found no regulatory action tied to ATM Token one way or the other. This is a negative/absence claim that cannot be affirmatively confirmed, only that no contradicting evidence was found.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in the summary
“ATM Token is an obscure BEP-20 token deployed on BNB Smart Chain that suffered a confirmed exploit on June 4, 2026, resulting in approximately $243,500 in losses.”
reviewerATM Token suffered a confirmed exploit on June 4, 2026 resulting in approximately $243,500 in lossesThe June 4 figure itself is accurate, but the page (summary, timeline and all sections) omits a second, substantially larger exploit of the same token 18 days later, which materially understates total investor losses and contract risk. - #2[partially supported][awaiting moderator]in section: The Exploit
“The exploit was flagged by security monitoring firm TenArmorAlert and subsequently analyzed by CertiK.”
reviewerThe exploit was flagged by security monitoring firm TenArmorAlert and subsequently analyzed by CertiKMinor naming error: the page itself is internally inconsistent, calling the firm "TenArmor" elsewhere (Broader BNB Chain Context section) but "TenArmorAlert" here and in the timeline. Sources indicate TenArmor is the firm, TenArmorAlert its alert handle. - #10[partially supported][awaiting moderator]in the timeline
“TenArmorAlert and CertiK security firms flag the exploit and publish technical analysis identifying the transferFrom() auto-swap flaw as the root cause.”
reviewerTenArmorAlert and CertiK security firms flag the exploit and publish technical analysis identifying the transferFrom() auto-swap flaw as the root cause (timeline entry)Same firm-name issue as the corresponding finding in sections[0]; also the detailed technical root-cause analysis is attributed to CertiK specifically in the sources, with TenArmor providing the loss estimate, so "publish technical analysis" jointly credited to both is a mild overstatement.
confirmed
8 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: The Exploit
“The attack transaction hash is reported as 0x37b90a337075cd2feea93b12780abe9f953dad476e1c1418a02447aaa6dcfd86.”
reviewerThe attack transaction hash is 0x37b90a337075cd2feea93b12780abe9f953dad476e1c1418a02447aaa6dcfd86Hash matches the cited article's BscScan link; page correctly hedges with "reported as" rather than asserting it independently verified on-chain. - #4[confirmed][no action needed]in section: The Exploit
“The attacker's address is reported as 0x7e7C1f0D567c0483f85e1d016718E44414CdBAFE, and the ATM token contract address on BNB Smart Chain is 0x4fd0878ee1bbf7b1019138e8eec746e5a5d5a205.”
reviewerThe attacker's address is 0x7e7C1f0D567c0483f85e1d016718E44414CdBAFE and the ATM contract address is 0x4fd0878ee1bbf7b1019138e8eec746e5a5d5a205Both addresses match what the cited source reports; page did not independently re-verify on BscScan but correctly attributes to the source. - #5[confirmed][no action needed]in section: The Exploit
“Security sources allege the attacker's address had been linked to previous token contract exploits dating back to 2025, though this claim has not been independently verified at Tier 1 or Tier 2 credibility level.”
reviewerSecurity sources allege the attacker's address had been linked to previous token contract exploits dating back to 2025, not independently verified at Tier 1/2Page's hedge language accurately reflects that this is an unconfirmed allegation from a Tier 2 source, not independently verified. - #6[confirmed][no action needed]in section: Technical Vulnerability
“The ATM Token contract embedded logic within transferFrom() that automatically swapped 20% of every transferred ATM token amount into BSC-USD via a DEX router.”
reviewerRoot cause was a non-standard transferFrom() that auto-swapped 20% of each transfer into BSC-USD via a DEX router, exploitable without flash loans or classical reentrancyBoth cited sources corroborate the technical description in detail, including the explicit statement that this was not a flash-loan or classical reentrancy attack. - #7[confirmed][no action needed]in section: Project Transparency and Audit Status
“No verified security audit for the ATM Token contract has been identified in publicly available sources.”
reviewerNo verified security audit, no public website/whitepaper/roadmap, team identity unknownConsistent with the cited source; this is an absence claim (no audit found) rather than a verified negative, but reasonably supported given no audit is referenced anywhere in reporting. - #8[confirmed][no action needed]in section: Project Response and Aftermath
“As of June 5, 2026 — one day after the exploit — the ATM Token project team had issued no official public statement.”
reviewerAs of June 5, 2026, the ATM Token project team had issued no official public statementDirect match to source wording and date. - #11[confirmed][no action needed]in section: Broader BNB Chain Context
“Adjacent incidents reported in the same week include the BY Token exploit ($88,400 drained on June 5, 2026) and the SKP Liquidity exploit ($212,000 drained on May 27, 2026).”
reviewerBY Token exploit drained $88,400 on June 5, 2026Both adjacent-incident figures and dates match their respective cited articles exactly. - #12[confirmed][no action needed]in section: Broader BNB Chain Context
“Security firms TenArmor and CertiK operate continuous monitoring for anomalous on-chain activity on BSC, and both flagged the ATM incident within hours of the attack.”
reviewerSecurity firms TenArmor and CertiK operate continuous monitoring on BSC and both flagged the ATM incident within hours of the attackUses the correct firm name "TenArmor" here (contrast with sections[0]/timeline[1] which say "TenArmorAlert"); same-day alert timing supports the "within hours" characterization.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.