Tapioca DAO

2024-10-18

Tapioca DAO exploit begins at approximately 12:00 PM UK time. Attacker, having compromised 0xRektora's private keys via social engineering, triggers Emergency Rescue function on TAP vesting contract and withdraws approximately 28–30 million TAP tokens.

2024-10-18

TAP token price collapses 93–97%, from approximately $1.43 to under $0.05, as attacker swaps 30 million TAP for 591 ETH.

2024-10-18

Attacker compromises USDO stablecoin contract and mints approximately 5 quintillion USDO. Approximately $2.8 million USDC and $1.58 million ETH drained from USDO/USDC Uniswap pool. Stolen assets bridged from Arbitrum to BNB Chain via Stargate.

2024-10-18

Tapioca Foundation, with assistance from SEAL911 and EnigmaDarkLabs/Fuzzland, executes counter-exploit recovering 996 ETH (~$2.7 million) from attacker before it could be laundered.

2024-10-18

ZachXBT publicly links the Tapioca DAO attack to a broader pattern of DeFi hacks (Nexera, Concentric, Masa, SpaceCatch, Reach, Serenity Shield, MurAll) attributed to North Korean state-sponsored threat actors using Contagious Interview / fake job scam vectors.

2024-10-19

Tapioca DAO offers attacker a $1 million USDT white-hat bounty with a deadline of October 22, 2024, in exchange for returning approximately $3.7 million in stolen funds.

2024-10-22

Bounty deadline passes with no response from attacker. Tapioca DAO revokes the $1 million bounty offer.

2024-10-22

Tapioca Foundation publishes post-mortem on Mirror identifying attack as social engineering / Contagious Interview method and attributing it to a North Korean group. DAO treasury reported at approximately $4.2–4.8 million, down ~45% from pre-attack.