BlackGold Hack

On December 12, 2022, an attacker exploited BlackGold (BGLD) on BNB Chain while holders were being migrated from an old BGLD token to a new one. DeFiHackLabs puts the total loss at about $18K for the whole transaction.

The old BGLD charged an extra fee on transfers. BlockSec identified this as the root cause: by sending old BGLD to a PancakeSwap pair and taking the excess back with skim(), the attacker could shrink the pair's BGLD reserve to almost nothing and then swap a tiny amount of BGLD for the other side of the pool. According to the DeFiHackLabs reproduction, the attacker used the trick twice in one transaction, first on the WBNB/BGLD pair and then on the old BGLD/DEBT pair. Between and after those drains, it converted leftover old BGLD to new BGLD through the migration contract and sold the new token for DEBT, finally swapping DEBT to USDT.

The existing record attributes the attack to a price difference between the two token versions during migration. BlockSec's analysis names the transfer fee instead; the reproduction shows the migration was used to cash out, but not how much of the profit came from it.

• Attacker (existing record): 0xf4fd2ebe7196c8e99e88bcc4aef69dda0e493b8f
• Exploit transaction: 0xea108fe94bfc9a71bb3e4dee4a1b0fd47572e6ad6aba8b2155ac44861be628ae
• Old BGLD: 0xC2319E87280c64e2557a51Cb324713Dd8d1410a3
• New BGLD: 0x169f715CaE1F94C203366a6890053E817C767B7C
• Migration proxy: 0xE445654F3797c5Ee36406dBe88FBAA0DfbdDB2Bb