BurgerSwap Hack

Reported loss $7.2M
Bnb Smart Chain
Malicious-token reentrancy funded by a flash swap

What happened

On May 28, 2021, BurgerSwap's BNB Smart Chain AMM was exploited in 14 transactions for about $7.2 million. Flash liquidity from PancakeSwap funded the operation, but the drain depended on reentrancy through a malicious token and faulty AMM reserve validation.

Technical root cause

BurgerSwap's Uniswap V2-derived swap path allowed callback-driven reentrancy and lacked the constant-product invariant validation needed to reject a second output calculated from stale reserves.

How it happened

The attacker created a non-standard token and paired it with BURGER. During a multi-hop swap, the token re-entered BurgerSwap before the relevant reserves were safely settled. Because the protocol lacked the constant-product invariant check used in Uniswap V2, it could honor a second output using stale accounting.

The flash swap was repaid within the transaction, leaving the extracted assets as the result.

Protocol details

Classification Reentrancy and AMM invariant failure
Protocol Type DEX
Affected asset / contract BURGER
Protocol links Website @burger_swap
Attacker Address 0x6c9f2b95ca3432e5ec5bcd9c19de0636a23a4994
Exploit Transaction 0xac8a739c1f668b13d0…0a6311e333

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Reentrancy

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes