Incident Overview
On January 27, 2026, the PGNLZ token on BSC suffered a ~$100,000 exploit when an attacker used a flash loan-funded attack to manipulate the PancakeSwap liquidity pool by exploiting the token's burn mechanism, purchasing massive quantities of PGNLZ that triggered automatic burns, drastically reducing pool reserves, then selling back a fraction of tokens for nearly all remaining USDT in the severely imbalanced pool.
The attacker executed a sophisticated multi-step attack leveraging Venus Protocol lending markets and Lista DAO's flash loan functionality. First, the attacker obtained a flash loan of 1,059.64 BTCB from Lista DAO's Moolah contract. The borrowed BTCB was immediately deposited into Venus Protocol as collateral, minting 5,205,855,324,429 vBTC tokens, which enabled the attacker to borrow 30 million USDT against this collateral.
With the borrowed USDT in hand, the attacker executed the core exploit against the PGNLZ-USDT PancakeSwap pool. The attacker swapped 23.3 million USDT for approximately 978.2 billion PGNLZ tokens. However, the PGNLZ token contract contains an automatic burn mechanism that triggered during the transfer, burning 4.24 trillion PGNLZ tokens to the dead address and distributing additional tokens as fees (LP dividends, burns, NFT rewards, and marketing).
This massive burn drastically reduced the PGNLZ reserves in the liquidity pool from over 4 trillion tokens to just 14.8 billion tokens, while the USDT reserves dropped from ~23.4 billion to only ~15.8 million. With the pool now severely imbalanced, the attacker sold back just 14.8 billion PGNLZ tokens and received 23.4 million USDT in return - nearly recovering the entire USDT spent. The attacker then repaid the 30 million USDT loan to Venus Protocol, redeemed the vBTC collateral to recover the original 1,059.64 BTCB, repaid the flash loan to Lista DAO, and transferred approximately 100.9 million USDT in profit to their address.
Liquidity Pool: PancakeSwap V2 USDT-PGNLZ 0x8Cd8E57B…b7E658
Attacker Address: 0xFE95ECc0…D4AA86
Attack Contract: 0xD93C837a…ef5aD7
Exploit Transaction: 0xc7270212…e08121
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to PGNLZ token, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next PGNLZ token
The PGNLZ token hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.