How much was lost in the Levyathan hack?

$1.5M Minted & Dumped, as publicly reported (July 30, 2021).

Levyathan Hack: $1.5M Minted & Dumped

Q: How was the Levyathan hack carried out?

Leaked Key. The MasterChef owner's private key sat in a public GitHub repo. The attacker used it to execute an ownership action through the project's own timelock — no exploit code required, just the team's published credentials.

July 30, 2021 · BSC

extracted

$1.5M

LEV tokens minted

1e26

addresses traced

transfers

What happened

On July 30, 2021, Levyathan Finance on BSC was destroyed by one of DeFi's most avoidable failures: the team had committed the private key of the MasterChef contract owner to a public GitHub repository. An attacker used it to regain ownership through the timelock and mint 100 septillion LEV tokens, dumping them into the pools and crashing the token to zero. ChainHint's trace reaches one hop out of the attacker's address and stops there: five transfers into three PancakeSwap pairs and one two-asset swap pool, every one of them a contract the trace will not walk through. Where the proceeds went after those four contracts is not something this trace answers.

How the funds moved

Step 1

Leaked Key

The MasterChef owner's private key sat in a public GitHub repo. The attacker used it to execute an ownership action through the project's own timelock — no exploit code required, just the team's published credentials.

Step 2

Infinite Mint

With owner rights restored, the attacker minted 100 septillion LEV and dumped them into the liquidity pools, draining ~$1.5M in real assets and zeroing the token.

Step 3

One Hop Out

Five transfers leave the attacker's address: LEV into a PancakeSwap pair twice, $33,801 in BUSD and $87,401 in WBNB into two more pairs, and 50.5 Binance-pegged ETH into a two-asset swap pool, which sends 50.48 anyETH straight back to that same address in the same transaction. Those four contracts and the attacker's own address are everything this trace holds, and nothing in it shows value leaving BSC.

Where the funds went

Read from the transfers in ChainHint's trace, not from press reports

First transfer

Jul 30, 2021

Last transfer traced

Jul 30, 2021

Hops traced

DEX swaps

ChainHint's trace of the Levyathan hack follows 15 transfers across 5 addresses and 1 hop, on Jul 30, 2021.

Visualized attack path

5 addresses · 15 transfers · Traced with ChainHint

View Interactive Graph →

Key findings

Root Cause

Private key in public GitHub repoNot a contract bug — an operational security failure. The owner key of the MasterChef contract was committed to a public repository, giving anyone who found it full mint authority.

Key LeakOpSec Failure

Where the Trace Stops

A swap pool, not an exitThe last transfer the trace holds sends 50.5 Binance-pegged ETH from the attacker's address into a contract that answers the Saddle-family StableSwap interface over exactly two assets, Binance-pegged ETH and anyETH. The swap's output, 50.48 anyETH, returns to that same address in the same transaction, so this trace shows nothing leaving BSC and no address receiving anything except those four contracts and the attacker's own. The largest endpoint it prices is a PancakeSwap ETH/WBNB pair at $121,833; the swap leg carries no 2021 valuation we trust. One hop, four contracts, and a read whose upper bound the provider never answered: everything past that is outside this graph.

Aftermath

Protocol never recoveredLEV went to zero within minutes of the dump. The project published a post-mortem acknowledging the leaked key and shut down.

Investigate your own incident

ChainHint traced the Levyathan hack in minutes.
Use the same tool for your case.