Tessera DAO’s TSR token plunged nearly 99% after an attacker allegedly minted 99 million tokens, sold them for millions in USDT, and moved the proceeds across chains.
Key Takeaways
- Tessera DAO’s TSR token fell about 99% following a suspected exploit involving abnormal token minting.
- An attacker reportedly minted 99 million TSR tokens on BNB Chain and sold them into the market.
- The minted tokens were exchanged for approximately $2.5 million in USDT before being transferred to Ethereum.
- On chain data shows 1,285.5 ETH has already been routed through Tornado Cash, making fund tracking more difficult.
What Happened?
Security researchers and blockchain investigators reported that Tessera DAO’s TSR token suffered a major security incident after an exploiter allegedly minted 99 million TSR tokens on BNB Chain. The newly created tokens were quickly sold, triggering intense selling pressure that wiped out liquidity and caused the token’s price to collapse by nearly 99%.
According to on chain findings shared by security firm PeckShield and analyst Spreek, the attacker converted the minted tokens into approximately $2.5 million worth of USDT before moving the funds to Ethereum.
🚨 @TesseraDao exploited on BSC, $2.4M drained via private key compromise.
— QuillAudits 🥷 (@QuillAudits_AI) June 2, 2026
The attacker didn’t find a bug in the code. They got the keys and used the protocol’s own functions against it.
TSR dropped from $5.50 to $0.000255 in minutes.
🧵 Full breakdown: pic.twitter.com/aKs21sFJBt
Massive Token Minting Triggers Market Collapse
The incident began when an unusually large amount of TSR tokens appeared on chain. Investigators found that approximately 99 million TSR had been minted and rapidly sold into the market.
The sudden influx of tokens created overwhelming sell pressure. As liquidity was drained, TSR’s market value quickly deteriorated, leading to a dramatic price collapse of roughly 99%.
The scale and speed of the transaction sequence have raised concerns within the crypto community about the security architecture behind the project’s token issuance mechanism.
Researchers noted that incidents involving unauthorized or abnormal token creation often point to weaknesses in permission management or flaws within smart contract design.
$2.5 Million Converted and Bridged to Ethereum
After selling the newly minted tokens, the attacker allegedly swapped the proceeds for around $2.5 million in USDT.
Blockchain data indicates that the funds did not remain on BNB Chain for long. The assets were bridged to the Ethereum network shortly after the sale, a common tactic used by attackers attempting to move funds across ecosystems before investigators can react.
The cross chain movement added another layer of complexity to the investigation, as analysts now need to track activity across multiple blockchain networks.
Tornado Cash Used to Obscure Fund Movements
Investigators reported that 1,285.5 ETH connected to the exploit has already been sent through Tornado Cash, a crypto mixing service designed to obscure transaction trails.
The use of a mixer significantly increases the difficulty of tracking stolen assets because it breaks the direct connection between sending and receiving addresses.
As a result, blockchain investigators are now focusing on identifying any remaining funds that have not yet entered privacy tools and determining whether additional associated wallets can be linked to the exploit.
Questions Grow Around Minting Controls
While the exact vulnerability behind the incident has not been publicly disclosed, current attention is centered on the project’s minting permissions and contract controls.
Investigators are expected to examine whether token issuance permissions were bypassed, improperly configured, or abused by someone with access to privileged functions.
The incident serves as another reminder of the risks associated with poorly secured token issuance systems. When minting permissions are not adequately restricted, attackers may be able to create large quantities of tokens, dump them on the market, extract liquidity, and transfer funds across chains within a matter of hours.
At the time of reporting, the full extent of losses and the root cause of the exploit remain under investigation.
CoinLaw’s Takeaway
In my experience, exploits involving token minting permissions can be among the most damaging because they allow attackers to create value out of thin air and immediately convert it into real assets. I found this incident particularly notable because the attacker moved from minting to selling, bridging, and laundering funds in a very short period of time. The case highlights why strong permission controls, regular contract audits, and continuous monitoring remain critical for every crypto project, regardless of its size.
