View source for Mobius DAO WBNB Deposit Price Miscalculation Drain

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/mobiusdaowbnbdepositpricemiscalculationdrain.php}}
{{Unattributed Sources}}

[[File:Mobiusdao.jpg|thumb|Mobius DAO Logo/Homepage]]MobiusDAO (MBU) claims to have created a next-generation reserve currency protocol featuring algorithmic monetary policy, native liquidity control, and asset-backed stability. Despite promises of innovation—including protocol-owned liquidity, automated supply adjustments, and bond-structured assets—the project launched with minimal infrastructure, no smart contract audits, and vague marketing language. Just days after launch, a critical bug in the contract's handling of decimal values allowed an attacker to mint 10¹⁸ times more MBU tokens than intended from a tiny WBNB deposit. This exploit drained over $2.15 million via PancakeSwap and Tornado Cash, effectively crashing the token. MobiusDAO has since contacted cybersecurity firms and law enforcement, and is reportedly planning a protocol relaunch, though recovery remains uncertain due to the attacker's laundering through Tornado Cash.<ref name="rektnews-19526" /><ref name="blockaidtweet-19527" /><ref name="cyversalerttweet-19528" /><ref name="dexscreener-19529" /><ref name="mobiusdaohomepage-19530" /><ref name="mobiusdaoapp-19531" /><ref name="bscscanexploit-19532" /><ref name="mobiusdao123twitter-19533" /><ref name="mobiusdao123twitter-19534" /><ref name="mobiusdao123twitter-19535" /><ref name="mobiusdaotweet-19536" /><ref name="mobiusdao123twitter-19537" /><ref name="mobiusdao123twitter-19538" /><ref name="mobiusdao123twitter-19539" /><ref name="mobiusdao123twitter-19540" /><ref name="mobiusdao123twitter-19541" /><ref name="mobiusdao123twitter-19542" /><ref name="quillaudits-19543" />

== About Mobius DAO ==
MobiusDAO (MBU) claims to have created the next-generation reserve currency protocol by integrating algorithmic monetary policies with native liquidity control. Their hybrid model reports to leverage the full capital structure hierarchy to optimize liquidity and ensure long-term protocol health through diversified stablecoin reserves and robust treasury collateral. The protocol is designed to deliver asset-backed stability with highly liquid backing per MBU token and transparent on-chain reserves, using a closed-loop feedback system to mitigate risks.

MobiusDAO emphasizes protocol-owned liquidity, controlling over 99% of its liquidity through a bonding mechanism that enables permanent liquidity pools and multiple automated liquidity controls. The dynamic monetary policy reportedly includes a Range Bound Stability (RBS) system that manages supply through automated minting and burning, and offers staking rewards through a "double-rebase" mechanism.

The protocol is designed to incentivize liquidity providers (LPs) to stake digital assets in liquidity pools in exchange for MBU tokens, deepening reserves and fostering a sustainable market-making ecosystem. MBU holders can stake tokens for governance rights and compounding rewards, aligned with a token release curve that promotes long-term engagement. Additionally, MobiusDAO introduced bond-structured assets to grow treasury reserves via time-locked deposits, converting short-term liquidity into lasting value and sustaining a deflationary tokenomic framework.

== The Reality ==
According to Rekt News, "MobiusDAO launched on May 8 with little more than a token address, a bare bones website, and some fancy buzz speak of “Dimensional Integration” for DeFi and RWAs."

The smart contract reportedly did not have any audits.

== What Happened ==
"An attacker deposited 0.001 BNB and minted 9.73 quadrillion MBU tokens – enough to drain $2.15 million in actual stablecoins."
{| class="wikitable"
|+Key Event Timeline - Mobius DAO WBNB Deposit Price Miscalculation Drain
!Date
!Event
!Description
|-
|May 11th, 2025 1:33:46 AM MDT
|BSC Exploit Transaction
|The exploit transaction on the Binance Smart Chain.
|-
|May 11th, 2025 2:05:00 AM MDT
|Blockaid Twitter/X Report
|Blockaid reports that a vulnerability in a smart contract's deposit function allowed an attacker to exploit a pricing miscalculation involving WBNB deposits. The contract erroneously multiplied the BNB price in USDT by 10¹⁸ twice, resulting in the minting of 10¹⁸ times more MBU tokens than intended. The attacker then traded the inflated tokens for USDT on PancakeSwap, draining the liquidity pool and collapsing the token’s value, and is now laundering the stolen funds through Tornado Cash.
|-
|May 11th, 2025 2:56:00 AM MDT
|Cyvers Alert Tweet Posted
|Cyvers Alerts also reported that over $2.15 million in Mobius Token ($MBU) was drained from smart contracts on the BNB Chain due to a targeted exploit. Their system detected the deployment of a malicious contract just two minutes before the attack, which then executed multiple harmful transactions against the victim’s address. The attacker ultimately funneled the stolen funds through Tornado Cash to obscure their trail. According to Rekt News and DexScreener, "the attacker was already dumping tokens until MBU's price flatlined".
|}

== Technical Details ==
"The bug? A decimal handling error that turned pennies into quadrillions."

Exploit TX: 0x2a65254b41b42f39331a0bcc9f893518d6b106e80d9a476b8ca3816325f4a150

Blockaid:
"The exploit contract calls the deposit function on contract 0x95e92b09b89cf31fa9f1eca4109a85f88eb08531.

This function accepts a deposit and mints the equivalent amount of MBU."

"The deposit function support USDT and WBNB. If the user had deposited WBNB, the contract calls getBNBPriceInUSDT to get the value of the deposited tokens."

"However, this flow has an error - this function returns the amount with decimals (X * 10 ** 18).

Yet, after calling to getBNBPriceInUSDT, the contract does this multiplication again - which leads to the caller being minted 10**18 more MBU tokens than they should’ve."

"Once the exploit contract had minted their tokens, they used PancakeSwap to trade it for USDT (draining liquidity from the pool and sending the token value to 0 along the way)."

QuillAudits:
"The attacker was funded with 10BNB through Tornado Cash. The attacker, through their malicious contract, initially called the deposit function on the contract with only 0.001 WBNB, worth about $0.67 at the time of writing. This little deposit helped the attacker to mint over 9.7T tokens."

"The deposit function accepts the deposit and mints an equivalent amount of MBU tokens in the sender’s address. In the function, whenever a user deposits WBNB, the function gets the price of BNB to calculate the amount of tokens to transfer."

"The price comes in from the function getBNBPriceInUSDT, which returns the price in 18 decimals. The price returned as seen in the above image is ~$656, which is correct.

The problem arises as the function returns the value in 18 decimals, the contract multiplies this value again by 10**18, minting an enormous amount of tokens.

Once the exploit was done, the attacker sold the tokens at the available PCS liquidity pools, siphoning around $2.15M."


== Total Amount Lost ==
Blockaid reports "$2.1M had been drained so far". They show a screenshot with 2157126.179 USDT.

Cyvers Alerts reports "over $2.15M".

Rekt News calls this a "$2.15 million magic trick".

The blockchain reports 2,157,126.179348943736411799 USDT.

The total amount lost has been estimated at $2,157,000 USD.

== Immediate Reactions ==
"MobiusDAO has contacted professional cybersecurity companies and global law enforcement agencies to report the incident. The token is currently under investigation, and the progress of the situation will be announced by the police at the same time."

== Ultimate Outcome ==
Sources consistently report that funds were brought to TornadoCash after the attack. Rekt News reports "21 neat transfers of 100 BNB each".

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
It appears that Mobius DAO is still attempting to pursue recovery through law enforcement. The attacker brought their funds through TornadoCash, which may make this process difficult.

The Mobius DAO protocol is reportedly working on relaunch plans.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-19526">[https://rekt.news/mobiusdao-rekt Mobius DAO - Rekt] (Accessed May 13, 2025)</ref>

<ref name="blockaidtweet-19527">[https://twitter.com/blockaid_/status/1921476644092452922 Blockaid - "Our exploit detection system had identified multiple malicious transactions targeting Mobius Token ($MBU) contracts. $2.1M had been drained so far." - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="cyversalerttweet-19528">[https://twitter.com/CyversAlerts/status/1921489580991119736 Cyvers Alerts - "Our system has detected an exploit on Mobius Token smart contracts, draining over $2.15M in Mobius Token ($MBU) on BNB Chain." - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="dexscreener-19529">[https://dexscreener.com/bsc/0xb5252fcef718f8629f81f1dfcff869594ad478c6 Mobius Token (MBU) Versus USDT Trading Pair - Dexscreener] (Accessed May 13, 2025)</ref>

<ref name="mobiusdaohomepage-19530">[https://mobiusdao.com/ Mobius DAO Homepage] (Accessed May 13, 2025)</ref>

<ref name="mobiusdaoapp-19531">[https://app.mobiusdao.com/ Mobius DAO Web Application] (Accessed May 13, 2025)</ref>

<ref name="bscscanexploit-19532">[https://bscscan.com/tx/0x2a65254b41b42f39331a0bcc9f893518d6b106e80d9a476b8ca3816325f4a150 Exploit Transaction With 2,157,126.179348943736411799 USDT - BSCScan] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19533">[https://twitter.com/MobiusDAO123/status/1922196634588307497 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19534">[https://twitter.com/MobiusDAO123/status/1921847836548735142 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19535">[https://twitter.com/MobiusDAO123/status/1921818864771281196 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdaotweet-19536">[https://twitter.com/MobiusDAO123/status/1921819107088859414 MobiusDAO - "MobiusDAO has contacted professional cybersecurity companies and global law enforcement agencies to report the incident. The token is currently under investigation, and the progress of the situation will be announced by the police at the same time." - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19537">[https://twitter.com/MobiusDAO123/status/1921467601227547104 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19538">[https://twitter.com/MobiusDAO123/status/1921467727006310628 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19539">[https://twitter.com/MobiusDAO123/status/1920612816219680814 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19540">[https://twitter.com/MobiusDAO123/status/1919958394925941147 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19541">[https://twitter.com/MobiusDAO123/status/1918919554429854008 @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="mobiusdao123twitter-19542">[https://twitter.com/MobiusDAO123/ @MobiusDAO123 Twitter] (Accessed May 13, 2025)</ref>

<ref name="quillaudits-19543">[https://www.quillaudits.com/blog/hack-analysis/mobius-token-exploit-breakdown Mobius Token Exploit Breakdown: $2.1M Lost due to Poor Logic - Quill Audits] (Accessed May 13, 2025)</ref></references>