79thVault's operator hot wallet was used to transfer 2.01 million 79AU tokens from the PancakeSwap 79AU and USDT pool, resulting in an estimated $12.5 million loss on BNB Chain. The tokens might be removed from the pool due to the wallet at 0x019bd8ed's privileged OPERATOR_ROLE function. The attacker then used multiple swaps to sell the 79AU, turning the proceeds into 16,249 BNB and drastically lowering the pool's USDT reserves.

2.01 Million 79AU Moved From the PancakeSwap Pool

Seven transfers using the USDT and 79AU trading pool marked the start of the activity. Through transactions involving 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000 tokens, 2.01 million 79AU were transferred to an external address. The operator wallet connected to 79thVault was the source of the movement.

After that, the tokens were sold through around 95 swaps back into the same PancakeSwap trading pair. The pool's USDT holdings dropped from approximately $15.2 million to $3.9 million as a direct result of this selling activity. The final result of the transactions was 16,249 BNB, which at the time of the event was worth almost $12.5 million.

OPERATOR_ROLE Function Enabled the Token Movement

The incident concerned a privileged function in the 79AU contract that an address with OPERATOR_ROLE may call. The feature made it possible to update the pool reserves and remove 79AU from the PancakeSwap pool.

Since the transactions did not rely on violating the underlying token contract, that permission is crucial to the occurrence. Instead, the action made advantage of an operator privilege that was already connected to the hacked wallet. The occurrence was described as a possible private key compromise in reporting based on Defimon's monitoring, and insider behaviour was also mentioned in other media.

The OPERATOR_ROLE was revoked following the unusual transactions. This eliminated the privileged access to the function that had been used during the drain for the impacted wallet.

16,249 BNB Taken as Pool Reserves Fell

16,249 BNB, or about $12.5 million, remained in the external flow after the conversion. Shortly later, a further 3.79 BNB was moved from the operating key to the same external address. Token movements related to the issue were increased by another 500,000 79AU that was transmitted to several addresses.

The sequence provides a clear picture of the accumulation of the claimed loss. Initially, the operator permission was used to remove 79AU from the liquidity pool. Following the sale of those tokens through many swaps, USDT was removed from the pair. The resultant value was removed from the protocol and transformed into BNB.

79thVault Offers 10 Percent Bounty

After the incident, 79thVault made an on-chain appeal to the address containing the remaining cash and revoked the OPERATOR_ROLE. In consideration for the restoration of the remaining assets, the team offered a 10% bounty.

Roughly 90% of the stolen money remained in an address under the attacker's control when the bounty was offered, according to event monitoring. Therefore, regaining the assets that remained after the initial conversion into BNB was the main focus of the response.

Rather than a traditional smart contract exploit, security monitoring companies and blockchain security trackers have linked the incident to a private-key compromise. Additionally, CertiK documented the hot wallet issue and the transfer of 2.01 million 79AU, which was later converted into 16,249 BNB.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Hackers Trick Revolut With Fake Italian Police Emails
2. NEAR Blocks $50M From Bitget Hackers
3. Bitget Freezes Withdrawals After $351.6M Hack
4. Payy Freezes Network After $1.83M Exploit
5. $90K Crypto Loss After Chrome Extension Hack

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.