LAXO Token Hack
What happened
On February 22, 2026, LAXO on BNB Chain lost approximately $190,540 across four exploit transactions. Attackers used the same burn-before-sync flaw to remove LAXO from the AMM pair, inflate its price, and extract BSC-USD, with copycats following the initial transaction.
LAXO's transfer logic burned tokens from the PancakeSwap pair when tokens were sent directly to it, then called sync() without compensating the paired BSC-USD reserve. Router exemptions and a secondary-pair path made the burn-on-transfer behavior reachable and broke the AMM's reserve invariant.
How it happened
The first attacker flash-loaned BSC-USD, acquired LAXO, and transferred tokens directly to the PancakeSwap pair. The token burned a large amount from the pair and synchronized the reduced reserve, making the remaining LAXO appear more valuable. The attacker sold into the inflated price, repaid the loan, and later copycat attackers repeated the pattern.
Protocol details
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert x.com
- report Report certik.com
- transaction BscScan: LAXO exploit transaction bscscan.com
- code DeFiHackLabs: LAXO exploit reproduction github.com
- analysis DeFiLlama defillama.com
- analysis CertiK: SOF/LAXO incident analysis certik.com
- analysis Olympix: LAXO token exploit olympix.security
- analysis NomosLabs: LAXO burn mechanism exploit nomoslabs.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
