What happened
On July 8, 2026, BFB's PancakeSwap BFB/WBNB pool on BNB Smart Chain was drained of about 350.6 WBNB (about $198,000).
Technical root cause
BFB's price-defense logic trusted manipulable pool reserves and allowed unbounded burns of the LP's BFB balance through zero-value EOA-to-EOA transferFrom calls.
How it happened
A flash-loan-funded attacker repeatedly pushed the pool price below BFB's price-defense threshold, triggered repeated pool burns with zero-value EOA-to-EOA transfers, then swapped dust BFB for the remaining WBNB after the BFB reserve collapsed.
Protocol details
Classification
Token & Share Accounting
Protocol Type
Token
Implementation language
Solidity
Attacker Address
0x3bfa85127c9871d3f74c30e36a618a77f0ae6b0f
Exploit Transaction
0xabcf5c5c846595b2d0…1f7aed3520
Evidence
- transaction BscScan attack transaction bscscan.com
- analysis Verichains: BFB Token Exploit Analysis blog.verichains.io
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
