BCE Token Hack

On March 23, 2026, the BCE token on BNB Chain was hit by a $679K exploit. An attacker took advantage of a flawed burn mechanism. This flaw allowed the burning of BCE tokens directly from the PancakeSwap liquidity pool.

The attacker also manipulated reserves through a deferred destruction feature. This was a token design flaw, not a flash loan attack.

The BCE token had a serious issue with its transfer hook and burn mechanism. When users sold BCE to the PancakeSwap pair, the token contract recorded a global scheduledDestruction variable. The problem arose when a normal transfer, not involving the pair, could trigger this scheduled burn directly from the PancakeSwap pool's balance and then call sync() to update reserves.

This shouldn't happen in typical AMM flows. The attacker took advantage of this by deploying two malicious contracts. First, they borrowed liquidity from Venus and bought BCE tokens.

Then, they executed a sell transaction that loaded the scheduledDestruction variable. The next step was crucial. They used a helper contract to trigger a transfer that caused the delayed burn to execute against the PancakeSwap pair's BCE balance.

When sync() was called, the pool's reserves became severely unbalanced. After the manipulation, the reserves showed 36.5 billion USDT but only 10,000 BCE tokens. With the BCE side nearly empty, the price calculation was totally distorted.

The attacker then made a final BCE sale that drained almost all USDT from the pool due to the flawed reserve ratio. After repaying the Venus loan, the attacker walked away with about $679,000 in profit. The entire attack occurred in a single transaction without needing flash loans.

Exploit tx:

https://bscscan.com/tx/0x85ac5d15…46d452