BCE Token Hack

Reported loss $679K
BNB Chain
Burn-Mechanism Exploit

What happened

In March 2026, the PancakeSwap BCE-USDT pool on BNB Chain lost roughly $679,000 in an incident attributed to the BCE token's burn mechanism. Contemporary reporting described it as a token-level exploit rather than a vulnerability in PancakeSwap itself.

Technical root cause

The token's burn and trading-control logic could be reached in a way that changed the AMM pool balance without preserving the assumptions used for reserve accounting. Token-level balance mutations require explicit analysis of their interaction with liquidity-pool pricing and swap flows.

How it happened

  1. Public reporting indicates that the attacker used two malicious contracts to work around BCE's normal trading restrictions and invoke burn behavior against the liquidity pool.
  2. Burning pool-held BCE altered the pool's token balance and reserve relationship.
  3. That imbalance could then be traded against to extract USDT.
  4. The incident illustrates how a token feature that changes balances can become dangerous when its effects on AMM reserves, transfer restrictions, and pool accounting are not modeled together.

Protocol details

Classification Token / Pool Reserve Manipulation
Protocol Type Exploit/Other
Implementation language Solidity

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes