79AU token exploited for $12.5M via compromised operator key with OPERATOR_ROLE abuse on BNB Chain; attacker drained liquidity pair and cashed out via BNB.
Security & Exploits ·
The 79AU token on BNB Chain suffered a $12.5M loss following compromise of its operator private key. Between 07:27 and 08:19 UTC on October 7, the attacker used the compromised OPERATOR_ROLE to extract 2.01M 79AU tokens from the PancakeSwap 79AU/USDT liquidity pair through seven transfers to a controlled address. The operator function normally permits small transfers from the pair to reward pools but carries no safeguards limiting extraction scale.
The attacker sold the extracted tokens back into the same pair across approximately 95 swaps, draining the USDT reserve from $15.2M to $3.9M and generating slippage profits. The proceeds—16,249 BNB valued near $12.5M—were moved to a single address. Forty-one seconds after the attacker's final outflow, the operator key itself sent 3.79 BNB to that same destination, indicating either full key compromise or insider involvement.
The operator role has since been revoked. An additional 500K 79AU went to a separate address, and a bounty message was dispatched from the compromised operator key. Whether the breach stemmed from wallet exposure, supply chain attack, or internal misconduct remains unclear; no statement from the 79AU team has detailed the attack vector or recovery timeline.