What happened
On 29 December 2025 an attacker used a flash loan to take about 149 BNB (around $130K) through the MSCST contract on BNB Smart Chain. BlockSec Phalcon flagged the attack.
The root cause was a missing access check on the MSCST contract's releaseReward() function. Anyone could call it. When called, it swapped half of a reward amount from MSC tokens into GPC and sent that GPC straight into the GPC/WBNB pool on PancakeSwap. Because an outsider could decide when this happened, the attacker could trigger it right after pushing the GPC price down and profit from the pool imbalance in the same transaction.
MSCST contract: 0xccd04073f4bdc4510927ea9ba350875c3c65bf81. Attacker: 0xB0720D8541cD2b6fC35cCC39ec84e84383A7000b. Attack transaction: 0x53fe7ef190c34d810c50fb66f0fc65a1ceedc10309cf4b4013d64042a0331156.
How it happened
- The attacker flash-borrowed about 46.8M GPC.
- The attacker sold all of it into the PancakeSwap GPC/WBNB pool for about 205 BNB, pushing the GPC price down.
- The attacker called the unprotected
releaseReward(), which swapped MSC into GPC and pushed that GPC into the already-manipulated pool. - The attacker bought back the GPC needed to repay the flash loan for only about 55 BNB and kept about 149 BNB.
Protocol details
Evidence
- report @hklst4r incident report x.com
- analysis DeFiLlama defillama.com
- analysis MSCST Flash Loan Attack: Price Manipulation Exploit (Verichains) blog.verichains.io
- analysis BSC On-chain MSCST Project Suffers Flash Loan Attack (Lookonchain feed) m.lookonchain.com
- analysis muscatsol.xyz page muscatsol.xyz muscatsol.xyz
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
