What happened
The attackers' addresses:
https://bscscan.com/address/0x472a2c88…9be255
https://bscscan.com/address/0x430ad7e1…8a4c7e
https://bscscan.com/address/0xfc6682db…770494
The transaction behind the attack:
https://bscscan.com/tx/0xe23ffa07…6d4da1
The root cause is a false deposit bug in the staking logic of Pinecone finance. In particular, the affected vault counts as valid deposits even no tokens are actually transferred in. The hacker has no sufficient PCT balance but stakes 200K PCTs to the vault. However, the tx still succeeds and credits the hacker with 200K valid PCTs staked:
https://bscscan.com/tx/0x10236426…fa2619
Overall, three hackers gathered 3.5 million PCTs, which were converted into 516.83 BNB (~$200,000).
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Post-mortem medium.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.