The audit was clean. The contracts were fine. The money left anyway.
In the days around December 2, 2021, BadgerDAO — a DeFi project built around bringing Bitcoin into decentralized finance — lost roughly $120 million of its users' funds. There was no flash-loan trick, no reentrancy bug, no clever math exploit against the vaults. The smart contracts did exactly what they were written to do. The attacker never had to break them, because the attacker never attacked them.
This is a companion discussion topic for the original entry at https://namefi.io/r/en/blog/the-badgerdao-frontend-attack