# Diamante: attacker uses stolen access keys to mint 161M unauthorized DIAM; exchanges suspend the token · pwn.watch > On Oct 27 2026 an attacker used stolen Diamante company access keys to take control of the DIAM token contract on BNB Smart Chain and create 161M unauthorized DIAM. Diamante says it alerted exchanges within 13 minutes and Bybit, MEXC, KuCoin, Gate and Blofin suspended DIAM within hours; about 93% of the unauthorized tokens are frozen or traced to restricted exchange accounts. The contract is back under Diamante's control in an MPC wallet, the unauthorized tokens are to be removed, and deposits, withdrawals and trading reopen after that. No loss figure has been published. Page: https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026 · generated 2026-10-28T13:47:08.848Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: Diamante DIAM token (BNB Smart Chain) - Started: 2026-10-27 - Affected: DIAM token contract on BNB Smart Chain ## Follow this incident - RSS (one item per update): https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026.json - This file: https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: MEXC suspends DIAM deposits and withdrawals at the project's request. (https://www.mexc.co/announcements/article/suspension-of-diam-deposits-and-withdrawals-17827791539389) - 2026-10-28: Founder says stolen company access keys were used to mint 161M DIAM; ~93% frozen or traced, contract moved to an MPC wallet, criminal complaint filed with UAE authorities. (https://x.com/chiragjetani/status/2115386146209620452) - 2026-10-27: Diamante posts an official security incident announcement: unauthorized activity by a malicious actor; affected withdrawals and transfers suspended with exchange partners. (https://x.com/diamante_io/status/2115183662954356858) ## Fix brief # Security brief: Diamante: attacker uses stolen access keys to mint 161M unauthorized DIAM; exchanges suspend the token Source: https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 11:44 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is On Oct 27 2026 an attacker used stolen Diamante company access keys to take control of the DIAM token contract on BNB Smart Chain and create 161M unauthorized DIAM. Diamante says it alerted exchanges within 13 minutes and Bybit, MEXC, KuCoin, Gate and Blofin suspended DIAM within hours; about 93% of the unauthorized tokens are frozen or traced to restricted exchange accounts. The contract is back under Diamante's control in an MPC wallet, the unauthorized tokens are to be removed, and deposits, withdrawals and trading reopen after that. No loss figure has been published. Severity detail: 161M unauthorized DIAM minted; exchange deposits, withdrawals and trading suspended; no loss figure published - Product: Diamante DIAM token (BNB Smart Chain) ## Affected versions - DIAM token contract on BNB Smart Chain ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 28, 2026: MEXC suspends DIAM deposits and withdrawals at the project's request. - Oct 28, 2026: Founder says stolen company access keys were used to mint 161M DIAM; ~93% frozen or traced, contract moved to an MPC wallet, criminal complaint filed with UAE authorities. - Oct 27, 2026: Diamante posts an official security incident announcement: unauthorized activity by a malicious actor; affected withdrawals and transfers suspended with exchange partners. ## Advisories - [Diamante: Official security incident announcement](https://x.com/diamante_io/status/2115183662954356858) (Diamante) - [Diamante founder: update on the $DIAM security incident on BNB Smart Chain](https://x.com/chiragjetani/status/2115385413745709113) (Diamante) - [Suspension of DIAM Deposits and Withdrawals](https://www.mexc.co/announcements/article/suspension-of-diam-deposits-and-withdrawals-17827791539389) (MEXC) ## Write-ups & news - [DIAM reports security breach, says legal action and asset recovery are underway](https://coinness.com/en/news/1173189) ## Caveats Diamante has not published a loss figure, the attacker's identity, or how the keys were stolen. Holders are told to avoid trading DIAM on DEXs until next steps are confirmed. --- Machine-readable: https://pwn.watch/i/diamante-diam-contract-key-theft-mint-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.