79thVault drained of over $12 million in suspected BNB Chain exploit
Tokenized gold platform 79thVault lost over $12 million from its PancakeSwap liquidity pool after privileged contract permissions allowed millions of 79AU tokens to be extracted and sold for BNB and USDT.
Tokenized gold protocol 79thVault suffered a suspected exploit on BNB Chain on Oct. 7, 2026, leading to millions of dollars drained from its 79AU PancakeSwap liquidity pool. Security firm CertiK reported that roughly 2.01 million 79AU tokens were sold using a privileged function and converted into approximately 16,249 BNB, valued at about $12.5 million.[2][4][5]
An investigation by blockchain analytics firm Bitquery revealed that the pool lost $14.35 million in USDT across two selling wallets. Although 79% of the pool's liquidity provider (LP) receipts had been burned to lock liquidity, an underlying transfer permission inside the 79AU token contract allowed tokens to leave the pool without payment. These tokens were subsequently sold back for USDT, bypassing the standard LP receipt redemption mechanisms that locked receipts are meant to prevent.[1][3]
On-chain records show a transaction transferring 16,249.12 BNB to an exploiter wallet at 10:10:47 UTC in block 126233690. Trader account @KookCapitalLLC noted that USDT reserves in the pool collapsed from $15.2 million to $3.9 million in about an hour. Following the transfer, the exploiter reportedly deposited 30 BNB to cryptocurrency exchange KuCoin, while the protocol team offered a 10% bounty in an effort to recover the drained funds.[2][4][5]
Key facts
- Security firm CertiK reported that 2.01 million 79AU tokens were sold via a privileged function, generating roughly 16.2k BNB worth approximately $12.5 million.
- An on-chain transaction transferred 16,249.12 BNB, valued at approximately $12.46 million, at 10:10:47 AM UTC on Oct. 7, 2026, in block 126233690.
- Bitquery reported that the 79AU PancakeSwap pool lost $14.35 million in USDT on Oct. 7 via two selling wallets despite 79% of LP receipts having been burned.
- A privileged permission inside the 79AU token contract allowed tokens to leave the pool without payment, enabling them to be sold for USDT without redeeming LP receipts.
- USDT in the PancakeSwap pool dropped from $15.2 million to $3.9 million in about an hour during the dump.
- The 79thVault team offered a 10% bounty to the exploiter for the return of the funds.
- The exploiter reportedly deposited 30 BNB to KuCoin following the incident.
Sources · 5 sources
- CR
CryptoSlateArticle ·
Locked liquidity did not stop this $14 million crypto pool drain The PancakeSwap pool for 79AU, 79thVault’s token, lost $14.35 million in USDT on Oct. 7 through two selling wallets, according to a Bitquery investigation published Oct. 8. Bitquery found that 79% of the pool’s liquidity-provider receipts had been burned. But a permission inside 79AU let tokens leave the pool without payment. Those tokens were then sold back for USDT, bypassing the need to redeem a liquidity receipt. Related Reading Crypto hackers exploit third-party Aave tool to steal 114 ETH PancakeSwap’s V2 documentation describes LP tokens as receipts representing a provider’s share of a pool. They are separate from the two assets traders exchange inside it. The exchange’s liquidity guide describes ordinary redemption: a provider selects a share to remove and receives both paired tokens. Sending receipts to an inaccessible address prevents their redemption. It does not disable swaps, since trading exchanges the underlying assets without cashing in a liquidity position. In PancakeSwap’s archived pair contract , separate operations handle LP redemption, swaps and updating recorded reserves to match token balances. The swap operation checks token input without consuming LP receipts. The reserve-update operation reads balances from the underlying token contracts. Burning LP receipts does not rewrite those contracts’ balance rules or revoke a privileged address’s token permissions. Related Reading Base’s Cobalt upgrade adds another rule to affect token balances What remained exposed At 12:53 UTC on Oct. 8, Bitquery identified two pull-authorized addresses: the deployer and a newly authorized wallet. Read-only simulations from either allowed removal of about 95% of the pool’s remaining 79AU. The read-only tests moved no funds. The same snapshot showed one wallet holding the unburned 21% of LP receipts, with ordinary redemption rights over that share. Related Reading Cardano’s Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped Establishing whether 79AU’s reported exposure has ended requires a fresh check of that transfer permission. The post Locked liquidity did not stop this $14 million crypto pool drain appeared first on CryptoSlate .
Open source - KO
kook@KookCapitalLLCPost on X ·
a tokenized gold vault on bnb chain just got drained for $12.5m one admin wallet dumped 2 million of its gold tokens straight into the pancakeswap pool..... the usdt in that pool went from $15.2m to $3.9m in about an hour all of it swapped into 16,249 binancecoin:native now the team is offering the hacker a 10% bounty tokenized gold with an admin key 😂
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
.@Bitquery_io traced $14.35M in $USDT drained from 79AU’s PancakeSwap pool on Oct. 7 despite 79% of LP receipts being burned. Burning LP receipts blocks ordinary redemption, not privileged 79AU token transfers. via @akibablade https://t.co/NXQ91sPls7
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 ALERT: CertiK flags a suspected 79Vault exploit moving $12.5M in BNB via a privileged function. https://t.co/ffB4dxEBqA
Open source - CP
Crypto Patel@CryptoPatelPost on X ·
79thVault EXPLOITED: $12.5M+ IN $BNB DRAINED @79thVault was reportedly exploited, with 10K $79AU tokens drained and swapped for 16.249K BNB, worth approximately $12.51M. The exploiter has since deposited 30 BNB to #KuCoin. https://t.co/e3w6VNQPAE
Open source