Hacken ($HAI token): Bridge private key leak from decommissioned server → unauthorized token minting → dump
Hacken — the DeFi security auditing firm — had its own token's bridge minting key left exposed on a decommissioned server, letting an attacker mint 900M $HAI tokens and crash the price 99%, extracting ~$170K.
Summary #
Hacken ($HAI token) suffered a Security Firm Token / Utility Token on 2025-06-20, resulting in a loss of approximately $170K.
What happened #
Hacken — the DeFi security auditing firm — had its own token's bridge minting key left exposed on a decommissioned server, letting an attacker mint 900M $HAI tokens and crash the price 99%, extracting ~$170K.
Linked factors #
- RD-F-006 — causal : Audit-deploy gap (RD-F-006 time between audit and deploy) [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Y — bridge architectural migration in progress at time of incident; old server credentials not rotated] || Audit-deploy gap — alternate field name [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Y — bridge architectural migration in progress at time of incident; old server credentials not rotated]
- RD-F-027 — causal : ★ Single admin EOA (not multisig, not timelock) [via cross-hack: Factor 18: Single Admin Key With No On-Chain Delay] || ★ Single admin EOA — when value mentions key compromise [via realtime_signals/Governance/admin action: Y — unauthorized minting via compromised minter role key]
- RD-F-032 — related : Timelock duration on upgrades = 0 [via cross-hack: Factor 18: Single Admin Key With No On-Chain Delay]
- RD-F-101 — illustrative : Large governance proposal queued — RT signal would have fired [via realtime_signals/Governance/admin action: Y — unauthorized minting via compromised minter role key]
- RD-F-146 — related : New deploys in last 30 days — fresh attack surface [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Y — bridge architectural migration in progress at time of incident; old server credentials not rotated]
- RD-F-166 — causal : Officially-deprecated surface still holds material value [via cross-hack: Factor 33: Decommissioned Infrastructure Retaining Live Credentials]
- RD-F-168 — related : Stale user approvals on deprecated router [via cross-hack: Factor 33: Decommissioned Infrastructure Retaining Live Credentials]