What happened
The PGNLZ token on BNB Smart Chain suffered an approximately $100,000 liquidity-pool exploit on January 27, 2026. The attack used a flash-loan-funded trade and PGNLZ's automatic burn/fee mechanics to leave its PancakeSwap pool severely imbalanced.
PGNLZ's deflationary fee and burn model did not validate the amount burned from the liquidity pool against the pool's reserves. The attacker exploited that accounting gap to collapse PGNLZ reserves and manipulate the PancakeSwap price before extracting the remaining USDT.
How it happened
The attacker borrowed BTCB, used it as collateral to borrow USDT, swapped a large amount of USDT for PGNLZ, and triggered the token's burn-on-transfer logic. The resulting reserve imbalance made the remaining pool tokens extremely valuable, allowing the attacker to sell back a small amount, drain USDT, repay the loans, and retain the profit.
Protocol details
Evidence
- report @CertiKAlert incident report x.com
- analysis DeFiLlama defillama.com
- analysis BlockSec: January 25–February 1, 2026 incident roundup blocksec.com
- analysis PANews — PGNLZ attack analysis panewslab.com
- analysis HTX / Marsbit — PGNLZ self-detonation analysis htx.com
- analysis CryptoKYT — PGNLZ/USDT burn and sync exploit coinkyt.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
