Odin.fun, a memecoin launchpad, was the victim of a $7 million hack in August 2025. The attackers took advantage of a vulnerability in the protocol’s liquidity automatic market maker (AMM) code to drain liquidity from the protocol.
Inside the Attack
The attack on Odin.fun began with the attackers introducing liquidity into the system by depositing SATOSHI, ODINPEPE, and other worthless tokens into the smart contract alongside BTC. Using mechanisms such as overweighted deposits and self-trading, they were able to take advantage of logical errors in the liquidity AMM to make the tokens appear much more valuable in relation to BTC.
By pumping up the perceived value of the deposited tokens, the attackers inflated the value of their deposits. This allowed them to make withdrawals from the platform totalling approximately 58.2 BTC, worth an estimated $7 million. Simultaneous attacks were performed by multiple accounts, several of which were created specifically to carry out this exploit.
After identifying the incident, the platform froze operations until security audits could be completed. The attack was blamed on sophisticated attackers from China despite the fact that the attacker exploited a basic price manipulation vulnerability. The project lacks sufficient funds in its treasury to compensate users and has engaged investigators and law enforcement to identify and pursue the attackers.
Lessons Learned from the Attack
The Odin.fun hack is a classic example of an AMM exploit. The protocol used its own internal logic to value various tokens, rather than relying on an external source of truth. This made it much easier for attackers to manipulate perceived token value, especially when using worthless tokens that no other user is trading. If the only pricing data comes from the attackers, then they can make worthless tokens look extremely valuable.
The AMM code was part of a recent update to the protocol, and there is no sign that the code was audited before release. As a result, code with trivial, well-known vulnerabilities was pushed on-chain and exploited to the tune of $7 million.
This incident demonstrates the importance of performing a comprehensive audit of all code before it is deployed into production. With multiple projects suffering hacks involving similar vulnerabilities, a smart contract auditor could and should have identified and addressed the vulnerability before release. To learn more about protecting your DeFi projects against top threats and ensuring code security before release, get in touch with Halborn.