PeckShield monitoring shows that the attacker of the operational hot wallet 79thVault has returned 15,000 BNB to a designated address of the project team, valued at approximately $11 million. The team confirmed the recovery of this batch of BNB in a public update and stated that it will be added back to the liquidity pool, with the resulting liquidity tokens to be permanently destroyed.

Before the return, PeckShield recorded that the attacker exchanged about 10,000 79AU for 16,249 BNB, valued at approximately $12.51 million, and deposited 30 BNB into KuCoin. Based on the initial 16,249 BNB, the 15,000 returned accounts for about 92%. Subsequent on-chain calculations cited by TokenPost indicate that the two wallets obtained approximately $14.35 million USDT, corresponding to earnings of 17,881 BNB, making the return ratio about 84%. The whereabouts of the remaining funds have not been clarified by the officials or monitoring parties.

The loss occurred on October 7 on the BNB Chain. The operational hot wallet usually only makes small transfers to the reward pool, but on that day, it transferred a total of 2.01 million 79AU in seven transactions, with amounts of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000, and 500,000. Subsequently, about 95 transactions sold back to the same trading pair. Defimon recorded that the USDT reserves in the pool dropped from $15.2 million to $3.9 million, and the attacker exchanged 16,249 BNB. The operational key later transferred another 3.79 BNB to the same external address.

The team attributed the cause to account permission management, stating that the attacker obtained the operator's private key and transferred tokens from the contract. Bitquery's on-chain verification noted that the hot wallet key signed the withdrawal, with the proceeds concentrated in three wallets; the attacker had previously requested to retain 25% on-chain. This claim comes from an investigative post, not an official team announcement.

The 30 BNB on KuCoin is currently the only publicly known inflow to an exchange. PeckShield has not updated whether these 30 BNB have been frozen, nor provided the address distribution of the remaining BNB. The team disclosed the return transaction but did not announce the final ratio of the white hat agreement.

This is not a secondary market purchase but a partial return of transferred funds. The buyer is the team-designated recovery address, the seller is the attacker's address, and the transaction involves 15,000 BNB. The event was driven by the pool withdrawal on October 7 and the return on October 9. The beneficiary is the liquidity pool; if the team adds back the BNB as promised and destroys the resulting liquidity tokens, this portion will not be recoverable; the pressure point is the remaining unrecovered difference and the holders of 79AU who sold after the USDT was withdrawn from the pool, as 30 BNB has already entered KuCoin, with the remaining whereabouts unclear.

The initial loss was approximately $12.5 million, and the return amount is about $11 million. The difference between these two figures has not been itemized by the officials.

Source: Public Information