Incident Overview
On February 14, 2026, the SOF token on BSC suffered a $248,626 exploit when an attacker used a flash loan to exploit a burn-before-sync vulnerability in the token's sell fee mechanism, draining the liquidity pool by artificially inflating the token price mid-transaction through a strategic burn of 787 SOF tokens.
The attacker flash-loaned over $590M and swapped 313.5M BSC-USD for 991,223 SOF tokens, routing them to a fee-exempt mining contract and leaving only 787 SOF in the pool. The attacker then sold 875 previously mined SOF tokens into the pool. SOF's flawed _update() function automatically burned 787 SOF (matching the pool's remaining balance) and called sync() to update the pool's internal records before calculating the BSC-USD return.
With the supply drastically reduced post-burn, the pool valued the few remaining SOF tokens at the entire 313.8M BSC-USD balance, allowing the attacker to extract it all. After repaying flash loans, the attacker kept 225,936 BSC-USD profit, laundering approximately $213K through FixedFloat and 20 BNB through Tornado Cash.
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to SOF Token, these are the critical security checks that could have prevented this incident (February 2026).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next SOF Token
The SOF Token hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.