79thVault on BNB Chain has been classified as a private key compromise by on-chain monitoring, resulting in a loss of approximately $12.5 million. The team's operational hot wallet typically only makes small transfers to the reward pool, but this time it transferred a large amount of tokens from the trading pair.

The monitoring flagged the event as Private Key Compromise, with the token being 79AU. There is a function in the contract callable only by OPERATOR_ROLE that can transfer any amount of 79AU directly from the PancakeSwap 79AU/USDT trading pair to any address, followed by a call to sync(). The sync() function re-prices based on the remaining balance after the transfer, raising the book price of the remaining tokens after the pool side is drained.

The transfers were made in 7 transactions, totaling 2.01 million tokens, with amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000 tokens transferred from the trading pair to an external address. The attacker then used approximately 95 exchanges to sell these 79AU back to the same trading pair. The USDT reserve in the pool dropped from $15.2 million to $3.9 million, about a quarter remaining. The cash-out resulted in 16,249 BNB, approximately $12.5 million.

The operational key then transferred an additional 3.79 BNB to the same external address, about 41 seconds later. Monitoring categorized the possibilities into two types: the attacker controlled the operational private key, or an insider was involved. Additionally, 500,000 79AU were transferred to other addresses. The OPERATOR_ROLE permission to call that function was revoked afterward. The project describes itself as a treasury-type decentralized finance within the CocoCat ecosystem, with a sell tax of 3.25% and an original supply of 210 million tokens.

No public explanation has been provided by the team for this transfer, nor has an auditing party released a report. What can be confirmed on-chain is the permission path and fund path: initiated by the hot wallet, drained from the trading pair, sold back after sync, and BNB leaving the pool. At an approximate BNB price of $768, 16,249 BNB corresponds to about $12.48 million, consistent with the estimated $12.5 million.

This is an event-driven pool drain, not a secondary market dump rumor. The seller is the address with operational authority, and the buyer is the USDT reserve in the trading pair; liquidity providers bear the burden of the reserve decline, while 79AU holders suffer from the price distortion after sync. The beneficiary is the external address that received 16,249 BNB. Revoking permissions only prevents further calls but does not recover the already cashed-out BNB.

Source: Public Information