79th Vault (79AU) hack — October 2026

79th Vault, a project on BNB Chain built around the 79AU token, lost about $12.5 million on 7 October 2026 when the PancakeSwap pool that held most of the token's dollar liquidity was drained. The 79AU contract, whose source code is not published, has a function reserved for an OPERATOR_ROLE that moves 79AU out of a chosen address to any recipient and then forces the pool to update its recorded reserves. According to Defimon Alerts and GoPlus Security, the role was held by a single hot wallet with no multisig or timelock, which had previously made only small transfers from the pool to the project's reward pool.

Between about 07:25 and 08:19 UTC that wallet made seven calls to the function, moving 2.01 million 79AU from the 79AU/USDT pair to one address in tranches of 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 tokens. That address sold the tokens back into the same pool in roughly 95 swaps. Defimon Alerts reported the pool's USDT reserve falling from about $15.2 million to about $3.9 million. The proceeds were converted to BNB, and at 10:10 UTC 16,249.12 BNB was sent to a consolidation address; this registry read both the first operator call and that transfer on-chain. At the CoinGecko price of about $769.50 for that hour, the BNB was worth about $12.5 million, which is the headline here; the pool's fall in USDT of about $11.3 million is kept as the lower end. CertiK, Defimon Alerts and GoPlus Security all reported the same 16,200-16,249 BNB.

The project at first described the disruption as a system upgrade. In a statement on 8 October it said an attacker had obtained an operator's private key through weaknesses in account permission management, that the affected permissions had been fixed, and that a white-hat settlement had been offered and the other side had replied. Defimon Alerts and GoPlus Security noted that 41 seconds after the BNB transfer the operator wallet sent its own 3.79 BNB to the same consolidation address, and that the settlement messages were sent from that same operator wallet, so they treat an insider as possible alongside a stolen key. The cause is recorded as a private key compromise on the project's own account, with no attribution.

On 9 October at 08:14 UTC the operator wallet sent an on-chain message asking for 15,000 BNB to be returned to a named address, with the rest kept as a bounty. When this registry read the balances later that morning, the address that had held 14,394.92 BNB, about 89% of the proceeds, held 296.81 BNB, and the named return address held 13,000 BNB. No return had been announced, and this registry could not trace the transfer between them, so nothing is recorded as recovered yet.