Black Hole Hack

On October 11, 2023, the Black Hole (BH) token on BNB Chain was drained through a price manipulation attack on its BH/USDT pair on PancakeSwap. Using a flash loan, the attacker bought BH with USDT at a low price, pushed the pool out of balance, and then pulled liquidity out at the manipulated price, leaving with an estimated 1,275,981 USDT (reported by outlets as about $1.27-1.28 million) after paying only about $4.16 in fees. The stolen USDT was converted to BNB and sent to Tornado Cash. BH was a Chinese token project marketed with the claim that selling would push the price up, and some observers questioned whether the incident was a rug pull rather than an outside exploit.

Attacker: 0xfdbfceea1de360364084a6f37c9cdb7aaea63464 Exploit transaction: 0xc11e4020c0830bcf84bfa197696d7bfad9ff503166337cb92ea3fade04007662 Attack contract: 0x216ccfd4fb3f2267677598f96ef1ff151576480c Tornado Cash deposit example: 0x807c3971e22101c9c42975f15c3fc47dc35c79b2ade60df6ae29359e3e98b288