What happened
In March 2026, the PancakeSwap BCE-USDT pool on BNB Chain lost roughly $679,000 in an incident attributed to the BCE token's burn mechanism. Contemporary reporting described it as a token-level exploit rather than a vulnerability in PancakeSwap itself.
The token's burn and trading-control logic could be reached in a way that changed the AMM pool balance without preserving the assumptions used for reserve accounting. Token-level balance mutations require explicit analysis of their interaction with liquidity-pool pricing and swap flows.
Case & protocol details
Attack Timeline
Public reporting indicates that the attacker used two malicious contracts to work around BCE's normal trading restrictions and invoke burn behavior against the liquidity pool. Burning pool-held BCE altered the pool's token balance and reserve relationship. That imbalance could then be traded against to extract USDT.
The incident illustrates how a token feature that changes balances can become dangerous when its effects on AMM reserves, transfer restrictions, and pool accounting are not modeled together.
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Report x.com
- report Report x.com
- analysis Website reference t.me
- analysis Crypto Adventure: PancakeSwap BCE-USDT pool incident cryptoadventure.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.