Uranium Finance
A BNB Chain AMM drained of about $50M on April 28, 2021 during a contract migration, after a single-character math error in its pair contracts let an attacker withdraw far more than deposited. The team suspected an internal leak; U.S. authorities later seized ~$31M.
Also known as: Uranium Finance, U92
Summary
Uranium Finance was an automated market maker on BNB Chain. On April 28, 2021, during the migration to its v2.1 contracts, an attacker exploited a calculation error in the v2 pair contracts — a "sanity check" used the wrong constant (1,000,000 instead of 10,000) — allowing them to send a tiny amount of value and withdraw far more, draining about $50 million across 26 token pairs. [1][2]
Background and recovery
Researchers noted the team had identified and fixed the bug for v2.1 but the vulnerable v2 code was already live, and the project itself suggested the incident may have stemmed from an internal leak; commentators flagged the possibility of an insider job or rug pull. An earlier April 2021 incident had also cost the project funds. In 2025, U.S. authorities (SDNY/HSI) seized about $31 million tied to the exploit. [1][2][3]
Bracketed numbers refer to the numbered sources listed below.
Linked scams & cases
Sources (3)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
