79thVault on BNB Chain Classified as Private Key Compromise, Loss Approximately $12.5 Million
79thVault on BNB Chain has been classified as a private key compromise by on-chain monitoring, resulting in a loss of approximately $12.5 million. The team's operational hot wallet typically only makes small transfers to the reward pool, but this time it transferred a large amount of tokens from the trading pair.
The monitoring flagged the event as Private Key Compromise, with the token being 79AU. There is a function in the contract callable only by OPERATOR_ROLE that can transfer any amount of 79AU directly from the PancakeSwap 79AU/USDT trading pair to any address, followed by a call to sync(). The sync() function re-prices based on the remaining balance after the transfer, raising the book price of the remaining tokens after the pool side is drained.
The transfers were made in 7 transactions, totaling 2.01 million tokens, with amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000 tokens transferred from the trading pair to an external address. The attacker then used approximately 95 exchanges to sell these 79AU back to the same trading pair. The USDT reserve in the pool dropped from $15.2 million to $3.9 million, about a quarter remaining. The cash-out resulted in 16,249 BNB, approximately $12.5 million.
The operational key then transferred an additional 3.79 BNB to the same external address, about 41 seconds later. Monitoring categorized the possibilities into two types: the attacker controlled the operational private key, or an insider was involved. Additionally, 500,000 79AU were transferred to other addresses. The OPERATOR_ROLE permission to call that function was revoked afterward. The project describes itself as a treasury-type decentralized finance within the CocoCat ecosystem, with a sell tax of 3.25% and an original supply of 210 million tokens.
No public explanation has been provided by the team for this transfer, nor has an auditing party released a report. What can be confirmed on-chain is the permission path and fund path: initiated by the hot wallet, drained from the trading pair, sold back after sync, and BNB leaving the pool. At an approximate BNB price of $768, 16,249 BNB corresponds to about $12.48 million, consistent with the estimated $12.5 million.
This is an event-driven pool drain, not a secondary market dump rumor. The seller is the address with operational authority, and the buyer is the USDT reserve in the trading pair; liquidity providers bear the burden of the reserve decline, while 79AU holders suffer from the price distortion after sync. The beneficiary is the external address that received 16,249 BNB. Revoking permissions only prevents further calls but does not recover the already cashed-out BNB.
Source: Public Information
ABAB AI Insight
79thVault positions itself within the treasury layer of the CocoCat ecosystem, with public actions being burn and sell tax, rather than an independent lending protocol. The original supply is 210 million tokens, and the project previously reported a cumulative net decrease of about 3.61% as of October 2. The design purpose of the operational hot wallet is to make small transfers to the reward pool. This loss did not arise from a miscalculation of the reward pool logic, but from the ability of the same key to call the trading pair extraction.
The capital path is a direct transfer of the pool via permissions. OPERATOR_ROLE transfers 79AU from the PancakeSwap trading pair and then calls sync(), effectively using an admin function to alter reserves, rather than receiving goods in the market. The 7 transactions from 10,000 to 500,000 tokens represent an increase after probing the limit. The 95 exchanges sell back the inflated tokens for USDT, then convert to 16,249 BNB to exit. The 3.79 BNB transferred 41 seconds later from the same operational key to the receiving address links external attacks and internal keys on-chain.
A comparison can be made to the direct transfer following the theft of Wintermute's hot wallet private key in 2022, as well as the repeated occurrences of "admin can extract tokens from paired contracts and sync" backdoors on BSC. The industry position reflects a failure in control periods: the project already has taxes, burns, and reward pools, yet the control point remains on a single hot wallet. The revocation of permissions occurred after the cash-out, only stopping a second extraction.
Structurally, this represents a transfer of pricing power. The price of an automated market maker should be determined by the reserves on both sides, but sync() hands over pricing power to roles that can alter reserves. The mechanism is that function permissions outweigh pool formulas. Whoever holds OPERATOR_ROLE can first drain one side and then transact based on the new balance, leaving liquidity providers to see a $11.3 million drop in USDT only after the transaction. The hot wallet typically only makes small transfers, and this permission was treated as operational convenience rather than a funding switch.
ABAB News · Cognitive Law
The key that can alter reserves is the pricing power of the pool.
Once a small hot wallet exceeds its authority, limits are merely a probe.
Revoking authority afterward cannot recover the coins that have already left the pool.