Hack history / 2023 / Fraud

LDO

Fraud on Sep 10, 2023 · False top-up

ONE SOURCE · 1 SOURCE

Lost

undisclosed

dollars at the time

Returned

none listed

as the sources state it

Rank

not ranked

collapses, frauds and later news are not ranked

What happened

On September 10, according to on-chain intelligence from the SlowMist security team, when the LDO token contract is processing a transfer operation, if the transfer amount exceeds the amount actually held by the user, the operation will not trigger the rollback of the transaction. Instead, it will directly return a `false` as the processing result. This approach is different from many common ERC20 standard token contracts. Due to the above characteristics, there is a potential risk of "fake top-up", and malicious attackers may try to use this feature to conduct fraud. On September 11, Lido stated that this behavior was expected and complies with ERC20 token standards. LDO and stETH are still safe. The Lido Token Integration Guide will be updated with LDO details to show this more obviously.

Details

Date: Sep 10, 2023
Kind: Fraud
Method: False top-up
How in: Insiders: rug pulls, frauds, collapses
Target: not stated
Chains: Ethereum

Reported by

SlowMist Hacked ↗

Related incidents

Gala Games 2023 · Hack or exploit · $4K
Upbit 2023 · Hack or exploit · undisclosed

Cite this page

SwanBluechip, "LDO fraud, Sep 10, 2023: undisclosed lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht214d79cec1/ (data as of 2026-11-01).

Open in the full list All incidents