79thVault Recovers 15,000 BNB
PeckShield monitoring shows that the attacker of the operational hot wallet 79thVault has returned 15,000 BNB to a designated address of the project team, valued at approximately $11 million. The team confirmed the recovery of this batch of BNB in a public update and stated that it will be added back to the liquidity pool, with the resulting liquidity tokens to be permanently destroyed.
Before the return, PeckShield recorded that the attacker exchanged about 10,000 79AU for 16,249 BNB, valued at approximately $12.51 million, and deposited 30 BNB into KuCoin. Based on the initial 16,249 BNB, the 15,000 returned accounts for about 92%. Subsequent on-chain calculations cited by TokenPost indicate that the two wallets obtained approximately $14.35 million USDT, corresponding to earnings of 17,881 BNB, making the return ratio about 84%. The whereabouts of the remaining funds have not been clarified by the officials or monitoring parties.
The loss occurred on October 7 on the BNB Chain. The operational hot wallet usually only makes small transfers to the reward pool, but on that day, it transferred a total of 2.01 million 79AU in seven transactions, with amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000. Subsequently, about 95 transactions sold back to the same trading pair. Defimon recorded that the USDT reserves in the pool dropped from $15.2 million to $3.9 million, and the attacker exchanged 16,249 BNB. The operational key later transferred another 3.79 BNB to the same external address.
The team attributed the cause to account permission management, stating that the attacker obtained the operator's private key and transferred tokens from the contract. Bitquery's on-chain verification noted that the hot wallet key signed the withdrawal, with the proceeds concentrated in three wallets; the attacker had previously requested to retain 25% on-chain. This claim comes from an investigative post, not an official team announcement.
The 30 BNB on KuCoin is currently the only publicly known inflow to an exchange. PeckShield has not updated whether these 30 BNB have been frozen, nor provided the address distribution of the remaining BNB. The team disclosed the return transaction but did not announce the final ratio of the white hat agreement.
This is not a secondary market purchase but a partial return of transferred funds. The buyer is the team-designated recovery address, the seller is the attacker's address, and the transaction involves 15,000 BNB. The event was driven by the pool withdrawal on October 7 and the return on October 9. The beneficiary is the liquidity pool; if the team adds back the BNB as promised and destroys the resulting liquidity tokens, this portion will not be recoverable; the pressure point is the remaining unrecovered difference and the holders of 79AU who sold after the USDT was withdrawn from the pool, as 30 BNB has already entered KuCoin, with the remaining whereabouts unclear.
The initial loss was approximately $12.5 million, and the return amount is about $11 million. The difference between these two figures has not been itemized by the officials.
Source: Public Information
ABAB AI Insight
The return of funds after the private key of the hot wallet was taken is a fixed sample in the crypto circle. In 2023, Euler Finance had approximately $197 million transferred away, and the attacker returned most of it in batches; in 2022, Poly Network managed to recover transferred assets. 79thVault is a smaller version: on October 7, the operational hot wallet transferred out 2.01 million 79AU in seven transactions, exchanged for about 16,249 BNB, and returned 15,000 on October 9. The team promised to add back to the liquidity pool and destroy the resulting liquidity tokens, effectively removing the returned coins from the withdrawable certificates.
The fund path is divided into three segments. The first segment is the USDT reserves in the trading pair, which dropped from $15.2 million to $3.9 million. The second segment is the BNB exchanged by the attacker, with PeckShield recording 16,249 BNB, and subsequent calculations mentioning 17,881 BNB. The third segment is the 30 BNB that entered KuCoin, while the remaining addresses have not been settled by the monitoring parties. Bitquery noted that the attacker had previously requested to retain 25% on-chain, but the team announcement did not confirm this ratio. The 15,000 BNB corresponds to about 92% of the initial figure and about 84% of the later figure.
For comparison, after the Bybit hack in 2025, only about 3.5% was frozen, and Bitget CEO Gracy Chen used this to explain that full recovery is not common. 79thVault is currently in a partial recovery phase: the designated address has received 15,000 BNB, while the KuCoin deposit and other wallets remain off the books. Control lies with the party holding the remaining private keys and exchange accounts, not with the already compromised pool.
Essentially, it is a temporary transfer of pricing power that is partially returned. The operational key originally only made small transfers to the reward pool, but once it could directly transfer tokens from the trading pair, the pool's pricing was determined by that key. The mechanism binds permissions and inventory together: withdrawals, sales, and exchanges for BNB occur within the same string of addresses, and returns only cover one segment of that. Destroying liquidity tokens can lock in the returned portion but cannot lock in the remaining difference still held in external addresses and exchanges.
ABAB News · Cognitive Law
The returned amount is inventory, not altered prices.
The first loss and the second accounting, with the difference in between.
If the hot wallet can transfer rewards, it can also transfer from the pool.