What happened
On January 28, 2026, XPlayer's XPL/USDT pool on BNB Smart Chain was exploited for approximately $717,000.
Technical root cause
XPL's burn mechanism could remove XPL directly from the liquidity-pool balance before synchronization. That reserve change made the pool price manipulable.
How it happened
The attacker used flash liquidity to trigger a faulty XPL burn path, reduced the pool's XPL reserves, distorted the pool price, and swapped out USDT.
Protocol details
Classification
Token
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
XPL
Protocol links
@XPlayer_Media
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
