|
Getting your Trinity Audio player ready...
|
A security incident affecting legacy CompanyDAO V1 smart contracts resulted in the unauthorized withdrawal of approximately **8,728.49 ZRO tokens** in October 2026, according to a publicly released incident and recovery report supported by on-chain transaction records.
CompanyDAO ceased operations in 2025. However, certain V1 smart contracts deployed on Ethereum in 2024 remained active after the platform discontinued development, maintenance, and technical support.
Incident Overview
According to the published investigation, an unauthorized actor obtained administrative privileges over the legacy contract infrastructure.
Blockchain records indicate that unauthorized administrative activity began in February 2026. In September, the attacker exploited the contract’s existing permission structure to mint approximately **2.99 million unauthorized ZROWRNT tokens**.
ZROWRNT tokens determined the holders’ entitlement to ZRO distributions. The unauthorized issuance gave the attacker control of approximately 99.85% of the warrant supply, substantially diluting legitimate holders’ distribution shares.
On October 16 and 20, the attacker-controlled wallets withdrew approximately **8,728.49 ZRO** across three transactions.
The incident involved unauthorized use of privileged administrative functions. The precise method by which access to the administrative key was obtained has not been conclusively established.
Recovery Actions
On October 20, a multisignature recovery transaction revoked the unauthorized administrative permissions, burned the newly issued warrants, and restored the original contract configuration.
The legitimate warrant supply was restored, and existing holders retained their original token balances.
According to the subsequent November 6 review, the affected service remained paused, with no additional unauthorized issuance or ZRO payouts identified after recovery.
However, the previously withdrawn ZRO tokens were not recovered. The original distributions affected by the incident could not be retrospectively corrected through the recovery transaction.
Historical Security Audit
CompanyDAO previously underwent a smart contract security audit conducted by SolidProof.
The historical audit documentation remains publicly available:
The previous audit is provided for historical reference only and should not be interpreted as independent verification of the October 2026 incident or its specific contract configuration.
Public Incident Documentation
A publicly available incident and recovery update documents the reported attack sequence, unauthorized token issuance, affected distributions, and subsequent recovery actions.
The accompanying blockchain references provide an opportunity for independent examination by security researchers, blockchain analytics providers, and relevant authorities.
Full incident and recovery report
The incident illustrates the potential risks associated with legacy smart contracts retaining administrative privileges after their original platforms have ceased operations.
About This Notice
This publication is a neutral informational security notice based on publicly available documentation.
It is not issued on behalf of CompanyDAO, its former operators, investors, or affected users, and does not constitute an independent security audit, legal assessment, or announcement of a compensation program.
Its purpose is to document the reported incident and make the relevant information accessible for security awareness and independent investigation.
Disclaimer: The information in this article is for general purposes only and does not constitute financial advice. The author’s views are personal and may not reflect the views of Chain Affairs. Before making any investment decisions, you should always conduct your own research. Chain Affairs is not responsible for any financial losses.
I’m your translator between the financial Old World and the new frontier of crypto. After a career demystifying economics and markets, I enjoy elucidating crypto – from investment risks to earth-shaking potential. Let’s explore!
