What happened
On February 22, 2026, the LAXO token on BNB Smart Chain was exploited for approximately $190,540 through a token-burn price-manipulation attack.
When LAXO was transferred to the pool, its transfer logic deducted fees, burned the remaining amount, and called sync() before the pool calculated its BSC-USD output; that reserve update made the token price artificially high.
Case & protocol details
Attack Timeline
The attacker flash-borrowed BSC-USD, acquired LAXO, and transferred LAXO to the PancakeSwap pool. The transfer path burned a large amount of LAXO and synchronized the pool before the BSC-USD output was calculated, inflating the implied token price for the withdrawal.
Evidence & learning
Attack pattern
Compare incidents →Proof of concept
1 availableSources and on-chain records
- report Report certik.com
- analysis Twitter/X Alert x.com
- analysis SOF/LAXO Incident Analysis certik.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.