Starstream / Agora Incident

On 07 April 2022 the Starstream Treasury was exploited via an externally callable execute() function in the DistributorTreasury contract, enabling an attacker to withdraw 532 million STARS. The attacker deposited the stolen tokens into Agora DeFi to borrow assets (METIS, WETH, MUSDC), bridged funds to Ethereum via an Exchange Proxy, and laundered value (including ~900 ETH sent to Tornado Cash), resulting in roughly $15M in protocol losses and contributing to Starstream's decision to wind down.