Odin.fun Exploited for $7M in BTC After Liquidity Pool Manipulation

Attackers exploited a vulnerability in Odin.fun’s automated liquidity market maker (AMM), siphoning 58.2 BTC—worth approximately $7 million—in a targeted attack that platform co-founder Bob Bodily has linked to China-based hacker groups.

The exploit, discovered early Tuesday, stemmed from a recent update to the platform’s liquidity engine. Blockchain data shows Odin’s BTC reserves plummeted from 291 BTC to just 232.8 BTC in under two hours during the breach.

“The issue was introduced in our latest AMM update,” Bodily posted on X. “Multiple malicious actors—primarily connected to groups in China—leveraged the flaw to extract a significant amount of BTC.”

The exploit involved depositing a near-worthless token, such as SATOSHI, alongside BTC into a shallow liquidity pool. By manipulating the token-to-BTC ratio—either through outsized deposits or self-arbitraging trades—the attackers inflated the token’s price within the pool. As AMMs rely solely on internal token balances to set prices, the attackers were then able to withdraw BTC at a grossly overvalued rate.

This type of manipulation is a known risk in AMM-based platforms, especially in thin markets lacking external price oracles or protective guardrails.

Bodily confirmed the incident involved multiple actors working in coordination and said a community member initially raised the alarm after detecting unusual liquidity activity. Odin has since frozen suspect accounts and isolated the exploit.

While the platform’s remaining assets are secure, Bodily acknowledged that Odin’s treasury cannot fully cover the losses. “We are actively working on a compensation plan for affected users,” he said, adding that a third-party security audit is underway and expected to take about a week.

Odin.fun has also reached out to U.S. law enforcement and is collaborating with Binance and OKX, both of which have initiated contact with Chinese authorities in an attempt to track and freeze the stolen funds.