The BadgerDAO Hack Explained: An Injected Script

Video transcript

The BadgerDAO hack was not a smart contract bug. A script Badger never wrote, served on its own web app, asked users to let an attacker spend their tokens.

Rekt put the loss at 120 million dollars. Badger's post-mortem, as CoinDesk reported it, said 130 million, with about 9 million recoverable.

Badger says three Cloudflare accounts got API keys without authorization. From November 10, the attacker used that access to inject a script asking users to approve a foreign address. On December 2, the drain began.

The script was built to stay hidden. It came and went through November, and only targeted wallets over a certain balance.

Cloudflare told Bloomberg its systems were not compromised. To a user, an injected approval request looks like a real one. Edge accounts can change what every user loads.

Five checks help. Compare the code users receive against your build, and inventory every account and key that can change production. Alert on new edge scripts, require MFA, and flag unlimited approvals.

Guardian covers this in two pentests. The WebApp Pentest tests the client side, including injection and bundle supply chain. The Infrastructure Pentest covers vendor accounts that can change production, like your CDN, and who holds admin.

Read the full article for the timeline and sources, or talk to Guardian about testing what your frontend serves.

The BadgerDAO hack was a frontend attack. The contracts did what users told them to do.

What told users to do the wrong thing was a script Badger never wrote, served on Badger's own web app.

That makes it a case for testing the web surface around a protocol, including the accounts that can change it.

What Happened

BadgerDAO ran vaults where users earned yield on wrapped bitcoin on Ethereum, rekt.news explained.

On December 2, 2021, starting at 00:00:23 UTC, an attacker began draining users' wallets, rekt reported.

Each victim had earlier approved the attacker's address to spend their tokens. Over 500 addresses had done so, per rekt.

One transaction took about 900 byvWBTC, worth over $50M. That victim had granted unlimited spending about six hours earlier, rekt said.

Badger then paused its contracts. Malicious transactions began to fail about 2 hours 20 minutes after they started, rekt reported.

Badger's post-mortem says most vaults were paused within 30 minutes of an alert on Discord, and older ones about 15 hours later, AMBCrypto reported.

On December 10, Badger published a technical post-mortem prepared with the security firm Mandiant.

How the Attack Worked

Badger's post-mortem is no longer on its site. This post quotes it as CoinDesk, AMBCrypto and ForkLog reported it.

The Cloudflare accounts

Badger pointed to a late September 2021 post on Cloudflare's forum. It said unauthorized users could register accounts and create API keys before email verification was complete.

Once the owner verified the email, those keys would give the attacker API access, Badger said.

Badger found that three accounts had been created and given API keys without authorization in August and September, AMBCrypto reported.

In mid-September, Badger engineers completed registration of one of them for legitimate Cloudflare work. The interface did not show that the account already existed, Badger said.

The injected script

From November 10, the attacker used that access to inject scripts through Cloudflare Workers into the HTML of app.badger.com.

Workers runs scripts that, in Badger's words, "operate on and alter web traffic as it flows through Cloudflare proxies."

The script intercepted web3 transactions. It prompted users to approve a foreign address to operate on the ERC-20 tokens in their wallet.

It was built to stay hidden. "They applied and removed the script periodically over the month of November, often for very short periods of time," Badger wrote.

"The attacker also only targeted wallets over a certain balance," it added.

A Cloudflare spokesperson told Bloomberg its systems were not compromised and Workers had no vulnerabilities, ForkLog reported.

Timeline and Loss

The reported totals differ:

• CoinDesk's headline and lead: $120 million.
• CoinDesk's body, summarizing Badger's post-mortem: $130 million stolen, about $9 million of it recoverable.
• rekt.news: "$120 million taken in various forms of wBTC and ERC20."

The $9 million had been moved by the attacker but not yet withdrawn from Badger's vaults, CoinDesk reported.

Badger patched the Cloudflare exploit, changed the account password and deleted or refreshed API keys where possible, CoinDesk reported.

It hired Mandiant and Chainalysis, and worked with authorities in the U.S. and Canada to recover funds.

What It Shows

The contracts were not the weak point. The page that built the transactions was.

An approval request looks the same to a user whether the team wrote it or an injected script did.

Bybit's 2025 loss ran through the same layer: see how a tampered frontend stole $1.5B from Bybit.

Accounts at a CDN or edge provider can change what every user loads. They deserve the care given to deploy keys.

Checks that surface or limit this kind of change:

• Compare the HTML and JavaScript users receive against the build you shipped.
• List every account and API key that can change production content.
• Alert on new edge scripts, rules or keys nobody on the team created.
• Require MFA on edge provider accounts, and review who holds admin.
• Flag unlimited or unexpected approvals in transactions your frontend builds.

Our guide to dApp frontend supply chain security goes deeper.

The LottieFiles lottie-player attack shows a drainer prompt reaching sites through a code library instead.

What Guardian's Pentests Cover

Guardian tests a web app and the accounts behind it in two separate pentests.

The WebApp Pentest is built for "the interface between a user and their funds."

Its scope includes the client-side surface: XSS, injection, CSRF, bundle supply chain, and what the frontend trusts from the API.

Guardian maps the application function by function at every privilege level, then tests each one. Frontend-only and backend-only scopes are available.

The Infrastructure Pentest covers vendor consoles: "SaaS accounts that can change production, like source control, CDN, and identity, and who holds admin."

Cloudflare is among the platforms it lists.

Frequently Asked Questions

How was BadgerDAO hacked?

Badger says an attacker used a Cloudflare API key its engineers never authorized to inject a script into app.badger.com. The script asked users to approve token spending to the attacker, who drained wallets on December 2, 2021.

How much was lost in the BadgerDAO hack?

CoinDesk's headline and rekt.news say $120 million. CoinDesk's body, summarizing Badger's post-mortem, says $130 million was stolen, about $9 million of it recoverable because it had not yet left Badger's vaults.

Was Cloudflare hacked in the BadgerDAO attack?

Badger's post-mortem pointed to a reported sign-up issue that let API keys be created before email verification. A Cloudflare spokesperson told Bloomberg its systems were not compromised and Workers had no vulnerabilities, ForkLog reported.

Were BadgerDAO's smart contracts exploited?

The drain ran on approvals that users signed through the tampered site, according to rekt.news and Badger's post-mortem. Badger then paused its contracts to stop further transfers.

Sources

• CoinDesk: BadgerDAO Reveals Details of How It Was Hacked for $120M (December 10, 2021)
• rekt.news: Badger, Rekt (December 2, 2021)
• AMBCrypto: BadgerDAO reveals cause behind exploit, details recovery plan (December 11, 2021)
• ForkLog: BadgerDAO team reveals details of $121 million hack (December 11, 2021)