79th Vault (79AU) operator-key compromise drains about $12.5M from the 79AU/USDT pool on BNB Chain

Summary

On 7 October 2026 (about 07:25-08:19 UTC), the 79th Vault project (token 79AU, BNB Chain) lost about $12.5M. The 79AU token has an OPERATOR_ROLE-only function that moves 79AU out of the PancakeSwap 79AU/USDT pair to any address and then calls sync(). The operator hot wallet executed 7 such calls moving 2.01M 79AU to an attacker EOA, which sold them back into the pair (~95 swaps), draining the pair's USDT reserve from $15.2M to $3.9M, and cashed out 16,249 BNB (Defimon Alerts, GoPlus Security, CertiK Alert).

Affected

• 79th Vault / 79AU token (BNB Chain), contract 0xc35ef0564751a27b468f791113c686c8eebaa9ca (source not verified on BscScan, per GoPlus)
• PancakeSwap 79AU/USDT pair liquidity and 79AU holders
• Fixed: OPERATOR_ROLE has since been revoked (Defimon, GoPlus); the project says emergency fixes and permission reviews have been applied

Impact

79th Vault states that the attacker obtained an operator's private key and used its privileges to withdraw tokens from the contract, then converted the proceeds to USDT and BNB. Defimon classifies it as a private key compromise and notes that 41 seconds after the cash-out the operator key sent its own 3.79 BNB to the same attacker address, so the attacker controls the key or it is insider activity; GoPlus likewise says a leaked key and insider activity both remain open. CertiK and GoPlus report that ~90% of the funds (about 14,394.92 BNB) were held at 0xa9537B40b02Af7Af8f1543aea3691992B2174F89 at the time of their analyses. The project says a white-hat settlement (10% bounty) was offered and discussions are ongoing.

Recommended actions

• Do not send funds to, or accept funds from, the attacker addresses listed in this advisory
• Exchanges and bridges: monitor and screen deposits from the listed attacker addresses
• 79AU holders and LPs: follow 79th Vault's official channels only; ignore unofficial refund or claim links
• Projects: avoid single-key privileged functions that can move pool balances; use multisig and timelocks for operator roles

Source & attribution

This 0xCERT advisory summarises alerts by CertiK Alert (https://x.com/CertiKAlert/status/2108114270559096916), Defimon Alerts (https://x.com/DefimonAlerts/status/2108100434942431441) and GoPlus Security (https://x.com/GoPlusSecurity/status/2108147742233284637), and the project's own statement (https://x.com/79thVault/status/2108244949963833685). Details may change; refer to the original sources for the authoritative record.