Badger DAO (Bitcoin-yield vaults on Ethereum): Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain
Badger DAO lost $120M after an attacker compromised their front-end and silently injected malicious token approvals into user transactions for 12 days before draining 500+ wallets.
Summary #
Badger DAO (Bitcoin-yield vaults on Ethereum) suffered a Yield Vault / BTC-on-DeFi on 2021-12-02, resulting in a loss of approximately $120M.
What happened #
Badger DAO lost $120M after an attacker compromised their front-end and silently injected malicious token approvals into user transactions for 12 days before draining 500+ wallets.
Linked factors #
- RD-F-006 — causal : Audit-deploy gap (RD-F-006 time between audit and deploy) [via dashboard_risk_factors/Exploited code newly deployed/upgraded: N — existing vault contracts; the attack vector was the front-end, not a new contract] || Audit-deploy gap — alternate field name [via dashboard_risk_factors/Exploited code newly deployed/upgraded: N — existing vault contracts; the attack vector was the front-end, not a new contract]
- RD-F-007 — causal : Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
- RD-F-062 — related : External keeper/relayer dependency not redundant [via cross-hack: Factor 8: Off-Chain Infrastructure Dependency]
- RD-F-096 — illustrative : New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Y** — malicious `increaseAllowance()` calls granting attacker's address unlimited approval began ~12 days before the drain; a user flagged t...]
- RD-F-105 — causal : DNS / CDN / frontend change detected [via cross-hack: Factor 8: Off-Chain Infrastructure Dependency]
- RD-F-146 — related : New deploys in last 30 days — fresh attack surface [via dashboard_risk_factors/Exploited code newly deployed/upgraded: N — existing vault contracts; the attack vector was the front-end, not a new contract]