What happened
Falcon Heavy Token (FH) was exploited on BNB Chain on 25 August 2026. A flash-loan-funded sequence drained approximately 19,999 USDT from the FH-USDT PancakeSwap V2 pair.
Technical root cause
Sell-side reserve synchronization ran before the seller’s net FH transfer reached the pair.
How it happened
- The attacker alternated FH buys and sells.
- On the sell path, the token removed FH from the pair and called
sync()before crediting the seller’s net FH input. - The router then interpreted the later balance increase as fresh input and paid outsized USDT outputs.
- The flash loan was repaid in the same transaction.
Protocol details
Classification
Protocol Logic
Protocol Type
Token
Implementation language
Solidity
Exploit Transaction
0x7a3cadc2f33e000b00…c2c0745bd2
Evidence
- analysis Falcon Heavy Token Exploit Analysis anomly.rs
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
