Incident Overview
On January 28, 2026, the XPlayer platform's XPL token on BSC suffered a $717,000 exploit when an attacker, showing similarities to the PGNLZ exploiter, used multiple flash loans totaling over $168 million to manipulate the PancakeSwap XPL-USDT pool by exploiting the token's automatic burn mechanism, purchasing massive quantities of XPL that triggered a burn of 3.078 trillion tokens, reducing pool reserves to nearly zero, then selling back a fraction for nearly all remaining USDT.
The attacker executed a sophisticated multi-layered flash loan attack remarkably similar to the PGNLZ exploit. First, the attacker obtained three flash loans from Lista DAO's Moolah contract: 1,034.94 BTCB, 285.68 WBNB, and 10,253.58 USDT. The WBNB was deposited into Venus Protocol as collateral, allowing the attacker to borrow 61,021.49 USDT.
Additionally, the attacker obtained flash loans from seven different PancakeSwap pools, accumulating approximately 168.27 million USDT total from all sources. With this massive capital, the attacker first made a small test purchase of 100 USDT worth of XPL tokens (receiving ~71.78 XPL) from the vulnerable pool. Then, the attacker executed the core exploit by swapping 217,118.80 USDT for 691,022.10 XPL tokens.
However, the XPL token contract contains an automatic burn mechanism (similar to PGNLZ) that triggered during the transfer, burning 3.078 trillion XPL tokens to the dead address via the "_autoBurnPoolByOwner" function. This massive burn catastrophically reduced the XPL reserves in the liquidity pool from approximately 694 million tokens to just 1 token, while the USDT reserves ballooned from ~965 million to 218.08 billion. With the pool now severely imbalanced, the attacker sold back just 57,405.76 XPL tokens and received 218,083.49 billion USDT in return.
The contract's TaxEvent shows an estimated USDT value from the sale of 218,083.49 billion with a profit tax of 32,712.51 billion USDT deducted. The attacker then unwound the position by swapping through multiple liquidity pools to convert assets back to USDT, repaid all flash loans sequentially (including fees), repaid the 61,021.49 USDT Venus loan, redeemed the vBNB collateral, converted it back to WBNB, and repaid all three Lista DAO flash loans. The final profit of 718,844.12 USDT was transferred to address 0x9dF9A1D1…86094F.
Liquidity Pool: 0x9B0FF36d…18ce70
Attack Contract: 0x80bd723D…399bD9
Profit Recipient: 0x9dF9A1D1…86094F
Exploit Transaction: 0x9779341b…ee2e49
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to XPlayer, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next XPlayer
The XPlayer hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.