What happened
On January 28, 2026, XPlayer's XPL/USDT pool on BNB Smart Chain was exploited for approximately $717,000.
Technical Root Cause
XPL's burn mechanism could remove XPL directly from the liquidity-pool balance before synchronization. That reserve change made the pool price manipulable.
Case & protocol details
Classification
Token
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
XPL
Official Website
layerx.xyz/
Protocol Twitter/X
@XPlayer_Media
Attack Timeline
The attacker used flash liquidity to trigger a faulty XPL burn path, reduced the pool's XPL reserves, distorted the pool price, and swapped out USDT.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- analysis BlockSec: January 25–February 1, 2026 incident roundup blocksec.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.