TesseraDAO: Someone Printed 99 Million Tokens and Walked Away With $2.5 Million

On Monday 1 June 2026, someone holding the master key to TesseraDAO's trading contract on BNB Chain made themselves its owner, printed 99 million new TSR tokens out of nothing, and sold every one of them. Within minutes the token had lost about 99% of its value. The seller left with roughly $2.5 million in digital dollars.

Nobody noticed for almost a day. The first public alarm came about 19 hours later, on 2 June, from an onchain analyst who posts as Specter. PeckShield, a blockchain security firm, confirmed it and added where the money had gone: across to the Ethereum network, and 1,285.5 ether of it already through Tornado Cash, a service built to make crypto payments untraceable.

TesseraDAO itself said nothing about it. Not that day, not that week, and not in the four months since.

A project that promised it could not be touched

TesseraDAO was a small project on BNB Chain, a blockchain closely tied to the Binance exchange. Its token, TSR, worked something like a share in the project: people bought it hoping the project would grow and the price would rise. Beyond that, the public record is thin. The project had no named team, a Telegram chat group, an account on X, and a published manifesto that talked about "super-sovereign settlement".

According to Rekt, a crypto investigations site that went through the project's own materials, that manifesto made three promises that matter here. It said admin rights had been permanently destroyed, so that the system would run on its own forever. It pointed to a security audit by CertiK, a well-known auditing firm. And it promised a 10-party multi-signature wallet, a shared account that needs many people to sign off before anything moves, like a company account that needs ten directors to approve a payment. Rekt reported that the audit was never completed, the admin rights were never destroyed, and the multi-signature wallet did not exist.

That gap between the promise and the code is the whole story.

How one key did all of it

A token like TSR lives inside a smart contract, a piece of code that moves money by itself according to fixed rules. Most contracts give someone an admin role at the start, a master key that can change settings, appoint other roles and, often, create new tokens, which is called minting. Minting is the crypto version of a company issuing new shares. Responsible projects either hand that key to a group, or "renounce" it, throwing the key away so that nobody can ever print more.

TesseraDAO's key still worked. QuillAudits, another security firm, published a step-by-step reading of the transactions, which Rekt reproduced. In one sequence, the attacker:

First, used the admin key to give their own wallet the contract's "trader" and "withdrawer" jobs, the permissions to trade the contract's money and take it out. Second, made themselves the contract's owner outright. Third, minted 99 million TSR straight into the contract. Fourth, used the contract's own trading function to swap that TSR for 2,475,659.06 USDT, a "stablecoin" designed to stay worth one dollar, from the pool of real money people had put in to make TSR tradable. Fifth, withdrew it. Then they came back for a second sweep of $16,224, leaving about 50 cents behind.

That pool, called a liquidity pool, is the automated market where buyers and sellers of a small token meet. It works like a shop that always holds some cash and some stock and sets the price by the ratio between them. Pour 99 million new tokens into it and the shop hands over all its cash for stock that is now worthless. Rekt put TSR's price at about $5.50 before the attack and $0.0002 afterwards.

QuillAudits' verdict, as Rekt reported it, was that there was no bug to find. The attacker had the keys and used the protocol's own functions. It also flagged that the compromised admin address was still active after the drain, transferring ownership of other TesseraDAO contracts.

Following the money

The roughly $2.49 million in USDT was moved through a bridge, a service that carries funds from one blockchain to another, onto Ethereum and swapped into ether. From there it went into Tornado Cash in small, standard-sized deposits. Tornado Cash pools coins from many users and lets each withdraw to a fresh address, so the link between who paid in and who took out is broken. The US Treasury sanctioned it in 2022 for laundering stolen funds, including money taken by North Korean hackers, then lifted those sanctions in March 2025. It remains the standard first stop for stolen ether.

By the time PeckShield posted, 1,285.5 ether had already gone through it. No exchange freeze, no recovery and no arrest has been reported. The attacker's wallet on BNB Chain, flagged by several firms, has not been linked to a named person or group.

Hack or exit?

Two days after the drain, Rekt asked in TesseraDAO's Telegram group when the project would tell people it had been exploited. The replies, by Rekt's account, were cheerful posts about the token. One said "all permissions burned", the very claim the attack had just disproved. A "final AMA", a question-and-answer session, was announced for the next day and did not happen. The official X account posted on 4 June: "Every protocol has a vision. What matters is the ability to execute it consistently." Two more general posts followed on 6 June. None mentioned the theft.

That silence is why holders and analysts openly asked whether this was a theft at all. When a single admin key can mint and sell, an outsider who stole the key and an insider who already had it leave exactly the same trail onchain. Rekt noted that the drained contract had sat untouched for about 40 days before the attack, and said plainly that this proves nothing. Nobody has produced evidence either way, and no one has been accused. The question stays open because the only people who could answer it have not.

The method is not new. Five days earlier, a forgotten deployer key at StakeDAO let a thief print 5.4 trillion tokens. Specter's alert on TesseraDAO also noted that the thief behind the September 2025 UXLINK hack was moving about $7.1 million through Tornado Cash at the same time. As of 16 October 2026, TesseraDAO has published no explanation, no compensation plan and no account of what happened to its key.