Incident case file

PositionManager — Spot-price share inflation drains USDT/BTCB vault

Incident date Sep 30, 2026Last updated Oct 8, 2026

2 views

ClosedBNB Chain L1 (EVM) — PancakeSwap V3Oracle / spot-price manipulationCluster: PM-SPOTPRICE-2026-09

Estimated loss

$32.1K

Affected users

Group joining is coming soon.

Investigation

75%

Facts and investigation

Ledger

Attacker

0xfc3fAcD67138966aB0c841E905B0C4BCA1AbE92F (BNB Chain EOA; a long-lived operator wallet, not a fresh address). Attack contract 0x97F119508FD5CC15E90b539B603895a5CfC56808. Operator unknown.

Funds moved to

At 02:37:08 UTC on Sep 30 the attack contract sent 32,080.604282546162934055 BSC-USD to the EOA. At 03:32:57 UTC (55 minutes later, tx 0x48f273e65b6d8c4fa48fa95cf5d3111ef60288fc87ca7dea7e1cda72ea80abc2) the EOA sent its whole balance, 32,082.250865363780472093 BSC-USD, to 0xedac2d8905bf2bf0033872d420c4ec6ef1ddd0c8. At 10:21:09 UTC that wallet forwarded 32,067 BSC-USD to 0x2fc81e79b0d49a6fa5a8cc6dbb95742fd2a3327e (tx 0xd4b838f55131ba71415d4fbb024266a20717291b5ada0d57221d4942842a1a2c). On Oct 3 at

Linked

Attack transaction 0x8725c094ae697f4df653f372dd01b627815ed46dbff2d75a75c5c83a15163da3 (block 124829770). Victim vault 0x7cedB2e5d7791c7D46c5C9d35EaC4775bc887F00; PancakeSwap V3 USDT/BTCB pool 0x46Cf1cF8c69595804ba91dFdd8d6b960c9B0a7C4; Chainlink BTC/USD feed 0x264990fbd0A4796A3E3d8E37C4d5F87a3aCa5Ebf; flash-loan source 0x238a358808379702088667322f80aC48bAd5e6c4. The attacker EOA shows 12 cross-chain bridges since Aug 7, 2026 (Ethereum, Base, Arbitrum, Optimism, Polygon, Avalanche, BNB Chain via Relay and Mayan) and keeps running 'create contract + swap' operations until at least Oct 4. 0xc590175E458b83680867AFD273527Ff58f74c02b, which exchanges BNB and stablecoins with the EOA, is an exchange-router contract, not an actor wallet (it also pays the NEAR Intents attacker). Address poisoning started within 30 seconds of the real transfer: look-alikes of 0xedac2d8905bf2bf0033872d420c4ec6ef1ddd0c8 and 0x2fc81e79b0d49a6fa5a8cc6dbb95742fd2a3327e send dust and fake tokens; none is a real destination.

Chronology

1 beat

Sep 30, 2026 at 02:37:08 UTC (block 124829770) one atomic transaction flash-borrowed 9,000,010 USDT, swapped 8,000,000 USDT into BTCB to crash the PancakeSwap V3 pool's spot price, ran 24 deposit/withdraw cycles of 1,000,000 USDT that minted inflated PM vault shares, then unwound and repaid. The attacker kept 32,080.604282 USDT; the vault pool lost 32,096.098596 USDT. At 03:32:57 UTC the attacker sent its whole balance to a fresh wallet, which at 10:21:09 UTC forwarded 32,067 USDT to a further address; look-alike addresses started poisoning the history within 30 seconds. ExVul and HashDit alerts are reported by one secondary source but were not seen directly; SlowMist Hacked and DeFiLlama did not list the incident as of Oct 3. The DeFiHackLabs PoC (merged) reproduces the amounts. No project statement was found.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)