What happened
On May 26, 2026, an attacker drained the SKP/USDT PancakeSwap V2 pool on BNB Chain. The reviewed execution analysis estimates about $234,135 removed from the pool and about $212,195 in attacker proceeds after flash-loan repayment and fees.
The SKP token's transfer path changed the PancakeSwap pair's token balance and invoked pair.sync() during a trade, allowing the pair's stored reserve to be refreshed with an almost-zero SKP side while the USDT side remained funded.
How it happened
The attacker borrowed flash liquidity, manipulated the token-side transfer flow to force the pool's SKP reserve near zero, then completed a fee-on-transfer router swap against the distorted reserve state before repaying the borrowed liquidity.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
