CrowdRingCircle (CRC) token exploited for $201K via reserve manipulation—attacker abused burn-from-pair mechanism to skew LP ratios and drain USDT from PancakeSwap pool.
Security & Exploits ·
CrowdRingCircle (CRC), a token on BNB Chain, lost approximately $201,000 in a reserve-manipulation exploit on July 16, 2026. The attacker extracted around 209,000 USDT and 35.86 million CRC tokens from the CRC/USDT liquidity pool on PancakeSwap, netting roughly $201,000 in USDT proceeds through a single transaction.
The vulnerability lay in CRC's token transfer logic, which included a mechanism to burn tokens sent to decentralized exchange pairs. Whenever a transfer targeted a flagged DEX pair address, the contract would deduct the amount directly from the pair's balance and trigger a reserve synchronization. The attacker exploited this by repeatedly depositing CRC into the pool, forcing consecutive burn-and-sync cycles that distorted the reserve ratio between CRC and USDT. This price distortion was then leveraged: using flash loans sourced from PancakeSwap and other lending protocols, the attacker executed a swap of a modest quantity of CRC and captured the inflated USDT output.
The core issue stemmed from the contract's _update override allowing the pair itself to be drained through a mechanism designed for token destruction. Whether the protocol team was aware of this interaction between the burn logic and the sync function, and whether recovery or remediation has been attempted, remains unclear.