What happened
On 9 September 2026 an attacker drained 2,984,557 BTX, worth about $77,512, from two BeatXswap vesting contracts on BNB Chain by manipulating the price they relied on. The contracts, LiquidityVestingConvert and LiquidityVestingConvertOnce, priced BTX from the PancakeSwap V3 USDT/BTX pool's current spot price (slot0()), with no TWAP, sanity check or deviation limit.
The attacker flash-borrowed 6,000,000 BTX, dumped it to crash the pool price, and made two small USDT deposits. Each deposit made a vesting contract pair its own BTX reserve with the USDT at the crashed price. The attacker then pushed the price back and kept the BTX. DeFiHackLabs puts the attacker's net profit at about $63,700 after costs.
How it happened
- The attacker flash-borrowed 15,950 USDT from Moolah as working capital and, inside a PancakeSwap Infinity Vault lock, took a 6,000,000 BTX flash loan.
- It sold BTX into the PancakeSwap V3 USDT/BTX pool (
0xA5Db84d7BCcb799fb31bd3c417D04d5bC29Da96D), crashingsqrtPriceX96so BTX looked extremely cheap. - It called the permissionless
deposit(10,000 USDT)on the first vesting contract._calculateQuote()readslot0()and sized the BTX side from the crashed price, so the contract minted a V3 LP position pairing the USDT with a large share of its own BTX reserve. - It pushed the price down further and called
deposit(2,000 USDT)on the second vesting contract, pulling its reserve the same way. The mint's 3% slippage check was measured against the already-manipulated quote, so it passed. - It reversed the swaps, buying back BTX and collecting the BTX the victims had just added as liquidity. It repaid the flash loans and sold the net ~2.98M BTX in a different, unmanipulated pool for about 77,512 USDT (tx
0xcc71a3bb131c73462b0f25533070113a63c85e942a22e18bc945eec184eb5799).
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
