What happened
On July 12, 2026, an attacker drained WBNB from the PHX/WBNB PancakeSwap pair on BNB Chain through a pair-burn accounting flaw.
Technical root cause
The PHX token’s pair-burn path reduced the effective PHX balance while the pair’s accounting remained exploitable, allowing the attacker to remove the WBNB reserve through a direct swap.
How it happened
The reproduced transaction buys PHX, sells PHX into the PancakeSwap pair, then swaps out nearly all of the pair’s WBNB in the same atomic flow.
Protocol details
Classification
Token & Share Accounting
Protocol Type
Token
Implementation language
Solidity
Evidence
- analysis PHX Pair Burn Exploit Analysis anomly.rs
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
