Incident Overview
On November 18, 2024, the BTB token on BNB Smart Chain (BSC) was exploited, leading to a loss of approximately $5,000. The attacker manipulated the BTB-BUSD price using a flash loan and exploited vulnerabilities in the contract's price oracle mechanism.
The attacker converted the 100,000 BUSD loan into 1,263,427 BTB, significantly reducing liquidity and inflating BTB’s price from 0.00379 BUSD to 1.638 BUSD—a 400x increase. Using the manipulated price, they swapped 3,052 BTB for 4,999 BUSD and later redeemed the remaining 1,260,375 BTB for 99,964 BUSD, completing the arbitrage. The exploit leveraged the outdated oracle, which relied solely on PancakeSwap reserves, allowing easy price manipulation.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to BTB Token, these are the critical security checks that could have prevented this incident (November 2024).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next BTB Token
The BTB Token hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.