🚨 79vault.com - Loss $12.5M (2026-10-07)

Token: $79AU
Network: BNB Chain

Type: Private Key Compromise

The 79AU token has an OPERATOR_ROLE-only function that moves any amount of 79AU straight out of the PancakeSwap 79AU/USDT pair to any address, then calls sync(). The team's operator hot wallet 0x019bd8ed normally uses it for small pair→reward-pool transfers. Between 07:27 and 08:19 UTC it sent 7 transfers totalling 2.01M 79AU from the pair to the attacker EOA (10K, 100K, 100K, 300K, 500K, 500K, 500K).

The attacker sold them back into the same pair through ~95 swaps. The pair's USDT reserve fell from $15.2M to $3.9M. The attacker cashed out 16,249 BNB (~$12.5M) to 0x629b368c. 41 seconds later the operator key sent its own 3.79 BNB to that same address, so the attacker controls the key (or it is an insider). The "project team" bounty message was also sent from this operator key. Another 500K 79AU went to 0xf219d073. OPERATOR_ROLE has since been revoked.

TX: https://bscscan.com/tx/0x18bc04788b034a1d8a09620770340977099cb4db7628e8931a5c4e625d37d0cc
Attacker: https://bscscan.com/address/0xc3e90f78a918594a605d584887b2775f4b80a099
Victim: https://bscscan.com/address/0x02d50b93e65d4572af5db2eeb6dd3c6ff08fda09 (79AU/USDT)
X: https://x.com/79thVault

@defimon_subscription_bot