Breaches and incidentsBriefConfirmed by two or more outlets
79thVault (79AU): single operator key drained the PancakeSwap pool
7 Oct 2026, BNB Chain: an address holding OPERATOR_ROLE pulled about 2.01M 79AU from the 79AU/USDT pool in seven transactions and sold it, about 16,249 BNB...
- Disclosed
What happened
- 7 Oct 2026, BNB Chain: an address holding OPERATOR_ROLE pulled about 2.01M 79AU from the 79AU/USDT pool in seven transactions and sold it, about 16,249 BNB (about USD 12.5M).
- Root cause: GoPlus found an OPERATOR_ROLE function that moves tokens out of the pool and syncs reserves, with no multisig or timelock, and unverified contract source on BscScan. Key compromise and insider action both remain possible (GoPlus). Defimon classified it as a private key compromise.
- Attribution: none.
- Response: the team first called it a “system upgrade”, then revoked the operator role. One outlet reports 15,000 BNB later returned; single source.
Sources
- https://forklog.com/en/news/79thvault-loses-12-5-million-in-attack-exploiting-privileged-function
- https://www.kucoin.com/news/flash/79thvault-hot-wallet-suspected-private-key-leak-causes-12-5m-loss
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.