BIGO Hack

On January 14, 2025, BIGO token was exploited through its auto-burn mechanism, resulting in the hacker obtaining nearly all DOGE (about 18k in USD value) from the relevant PancakeSwap pair.

The attack stemmed from the _autoBurn function within the BIGO token’s transfer logic. When the attacker sent a small amount of ETH to the contract, they could set the burnAmount variable. After exchanging a large amount of DOGE for BIGO, they invoked the transfer function, triggering _autoBurn and drastically reducing the BIGO balance in the PancakeSwap pair.

With the pool now misaligned, the attacker swapped back to DOGE at a premium, draining almost all DOGE from the liquidity pool.

Attack Transaction:

Tx 0x8c9d…b9c9