Dango Exploit Drains $1.9M But Recovered Funds Fully

Background and Context

Dango had only recently launched its DEX and introduced an insurance fund designed to absorb trading-related losses and protect platform stability. Additionally, the protocol included a donation feature that allowed users or third parties to contribute liquidity to the insurance pool.

However, the smart contract failed to sanitize inputs correctly. Because the function accepted non-positive donation values, the attacker exploited the flawed accounting logic and drained approximately $1.9 million in USDC collateral. Notably, the exploit affected the insurance layer only and did not put user positions or trader balances at risk.

Similar donation-style exploits have appeared in DeFi before. For example, the Resupply protocol exploit in June 2025 involved attackers abusing faulty vault accounting. They deposited validation logic, leading to a $9.5 million loss. Likewise, comparable vulnerabilities have affected lending and yield protocols such as Venus and multiple ERC-4626 vault implementations.

These incidents continue to highlight how simple input validation failures can escalate into multi-million-dollar losses.

Team’s Response and Recovery Efforts

Dango responded quickly. Within minutes of detecting the exploit, the team paused the chain to prevent further movement of funds. At the same time, they worked with SEAL_911, a well-known crypto security response network, to alert Circle and major centralized exchanges in order to freeze any bridged USDC where possible.

Although the attacker initially moved funds across the bridge, rate limits significantly reduced the damage. Only $410,010 was successfully bridged to Ethereum, while approximately $1,490,012 remained recoverable on Dango’s own chain. The team later confirmed that all funds have now been fully recovered, and importantly, no user losses occurred.

Moreover, the exploiter has reportedly been identified as a white-hat actor, and Dango has opened bug bounty discussions as part of the resolution process. The vulnerable donation logic has now been completely removed, and the team is conducting further security reviews before restarting operations. Following the Dango exploit, the vulnerable donation logic has now been completely removed, and the team is conducting additional security reviews before relaunching operations.

Implications and What Lies Ahead

This incident once again shows that DeFi exploits do not always require complex attack vectors. In many cases, basic business logic flaws, especially around fund accounting and edge-case validation, remain the biggest risk. For perpetual DEXs, insurance funds are especially sensitive because they serve as the final layer of loss absorption during extreme volatility.

Therefore, even though this exploit did not affect users directly, it raises broader concerns around pre-launch audits, invariant testing, and real-time monitoring systems. In the short term, Dango has postponed its points farming program, which may temporarily slow platform momentum and user activity.

However, the full recovery of funds and the transparent response could ultimately strengthen market confidence, especially compared with exploits where funds remain unrecovered. This event is likely to push newer perp DEXs toward stricter audit standards for insurance fund mechanics and donation modules before launch.